asaihost-nodejs 0.0.8 → 0.0.9

package/dist/asaihost-nodejs.cjs

@@ -940,13 +940,86 @@ function deUserInfoWithAsai(userinfo, $asai) {
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, deUserInfoWithAsai, "deUserInfoWithAsai");
 
+// src/ws/ws-probe.ts
+
+function isWsStillActive(ws2) {
+  if (!ws2) return false;
+  const state = ws2.readyState;
+  return state === _ws.WebSocket.CONNECTING || state === _ws.WebSocket.OPEN;
+}
+_chunkSMVZ3ZDJcjs.__name.call(void 0, isWsStillActive, "isWsStillActive");
+function getWsProbeTimeoutMs($asai) {
+  return _optionalChain([$asai, 'optionalAccess', _109 => _109.hostconfig, 'optionalAccess', _110 => _110.tm, 'optionalAccess', _111 => _111.d]) || 3e3;
+}
+_chunkSMVZ3ZDJcjs.__name.call(void 0, getWsProbeTimeoutMs, "getWsProbeTimeoutMs");
+function probeWsAlive($asai, wsclient, timeoutMs) {
+  const waitMs = _nullishCoalesce(timeoutMs, () => ( getWsProbeTimeoutMs($asai)));
+  return new Promise((resolve6) => {
+    if (!wsclient || !isWsStillActive(wsclient)) {
+      resolve6(false);
+      return;
+    }
+    let settled = false;
+    const finish = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, (alive) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      try {
+        _optionalChain([wsclient, 'access', _112 => _112.off, 'optionalCall', _113 => _113("message", onMessage)]);
+      } catch (e16) {
+      }
+      resolve6(alive);
+    }, "finish");
+    const onMessage = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, () => finish(true), "onMessage");
+    const timer = setTimeout(() => finish(false), waitMs);
+    try {
+      _optionalChain([wsclient, 'access', _114 => _114.once, 'optionalCall', _115 => _115("message", onMessage)]);
+      wsclient.send(JSON.stringify({ ty: "publish/web", db: "pong" }));
+    } catch (e17) {
+      finish(false);
+    }
+  });
+}
+_chunkSMVZ3ZDJcjs.__name.call(void 0, probeWsAlive, "probeWsAlive");
+function terminateWs(wsclient) {
+  if (!wsclient) return;
+  try {
+    _optionalChain([wsclient, 'access', _116 => _116.terminate, 'optionalCall', _117 => _117()]);
+  } catch (e18) {
+  }
+  try {
+    _optionalChain([wsclient, 'access', _118 => _118.close, 'optionalCall', _119 => _119()]);
+  } catch (e19) {
+  }
+}
+_chunkSMVZ3ZDJcjs.__name.call(void 0, terminateWs, "terminateWs");
+async function clearStaleWsIfDead($asai, hostdir, us, existingWs) {
+  if (!us || us === "asai") return true;
+  const map = _optionalChain([$asai, 'access', _120 => _120.connectionsws, 'optionalAccess', _121 => _121[hostdir]]);
+  if (!existingWs) {
+    if (_optionalChain([map, 'optionalAccess', _122 => _122[us]])) delete map[us];
+    return true;
+  }
+  if (!isWsStillActive(existingWs)) {
+    terminateWs(existingWs);
+    if (_optionalChain([map, 'optionalAccess', _123 => _123[us]]) === existingWs) delete map[us];
+    return true;
+  }
+  const alive = await probeWsAlive($asai, existingWs);
+  if (alive) return false;
+  terminateWs(existingWs);
+  if (_optionalChain([map, 'optionalAccess', _124 => _124[us]]) === existingWs) delete map[us];
+  return true;
+}
+_chunkSMVZ3ZDJcjs.__name.call(void 0, clearStaleWsIfDead, "clearStaleWsIfDead");
+
 // src/ws/auth.ts
 function getWsUserinfo(req, $asai) {
   try {
-    const raw = _optionalChain([req, 'access', _109 => _109.headers, 'optionalAccess', _110 => _110["sec-websocket-protocol"]]);
+    const raw = _optionalChain([req, 'access', _125 => _125.headers, 'optionalAccess', _126 => _126["sec-websocket-protocol"]]);
     if (!raw) return null;
     return deUserInfoWithAsai(raw.split("##"), $asai);
-  } catch (e16) {
+  } catch (e20) {
     return null;
   }
 }
@@ -960,7 +1033,7 @@ function listOnlineWsUsers($asai, hostdir) {
       if (!us || us === "asai") continue;
       if (isWsStillActive(ws2)) {
         users.push(us);
-      } else if (_optionalChain([map, 'access', _111 => _111[dir], 'optionalAccess', _112 => _112[us]]) === ws2) {
+      } else if (_optionalChain([map, 'access', _127 => _127[dir], 'optionalAccess', _128 => _128[us]]) === ws2) {
         delete map[dir][us];
       }
     }
@@ -973,10 +1046,10 @@ function isUserOnlineOnWs($asai, us, hostdir) {
   const map = $asai.connectionsws || {};
   const dirs = hostdir ? [hostdir] : Object.keys(map);
   for (const dir of dirs) {
-    const ws2 = _optionalChain([map, 'access', _113 => _113[dir], 'optionalAccess', _114 => _114[us]]);
+    const ws2 = _optionalChain([map, 'access', _129 => _129[dir], 'optionalAccess', _130 => _130[us]]);
     if (!ws2) continue;
     if (isWsStillActive(ws2)) return true;
-    if (_optionalChain([map, 'access', _115 => _115[dir], 'optionalAccess', _116 => _116[us]]) === ws2) delete map[dir][us];
+    if (_optionalChain([map, 'access', _131 => _131[dir], 'optionalAccess', _132 => _132[us]]) === ws2) delete map[dir][us];
   }
   return false;
 }
@@ -986,13 +1059,13 @@ function kickUserWs($asai, us, hostdir) {
   const map = $asai.connectionsws || {};
   const dirs = hostdir ? [hostdir] : Object.keys(map);
   for (const dir of dirs) {
-    const ws2 = _optionalChain([map, 'access', _117 => _117[dir], 'optionalAccess', _118 => _118[us]]);
+    const ws2 = _optionalChain([map, 'access', _133 => _133[dir], 'optionalAccess', _134 => _134[us]]);
     if (!ws2) continue;
     try {
       ws2.close();
-    } catch (e17) {
+    } catch (e21) {
     }
-    if (_optionalChain([map, 'access', _119 => _119[dir], 'optionalAccess', _120 => _120[us]]) === ws2) delete map[dir][us];
+    if (_optionalChain([map, 'access', _135 => _135[dir], 'optionalAccess', _136 => _136[us]]) === ws2) delete map[dir][us];
   }
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, kickUserWs, "kickUserWs");
@@ -1002,42 +1075,36 @@ async function removeSessionOnWsClose($asai, us, token) {
     const sessions = await store.getSessions();
     const match = sessions.find((s) => s.us === us && s.pub === token);
     if (match) await store.removeSession(match.id);
-  } catch (e18) {
+  } catch (e22) {
   }
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, removeSessionOnWsClose, "removeSessionOnWsClose");
-function isWsStillActive(ws2) {
-  if (!ws2) return false;
-  const state = ws2.readyState;
-  return state === _ws.WebSocket.CONNECTING || state === _ws.WebSocket.OPEN;
-}
-_chunkSMVZ3ZDJcjs.__name.call(void 0, isWsStillActive, "isWsStillActive");
 function rejectIncomingWs(ws2, db) {
   const payload = JSON.stringify({ ty: "publish/web", db: { exit: 1, type: "err", ...db } });
   try {
     ws2.send(payload, () => {
       try {
         ws2.close();
-      } catch (e19) {
+      } catch (e23) {
       }
     });
-  } catch (e20) {
+  } catch (e24) {
     try {
       ws2.close();
-    } catch (e21) {
+    } catch (e25) {
     }
   }
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, rejectIncomingWs, "rejectIncomingWs");
-function isOkWs($asai, hostdir, ws2, _req, hostcfg) {
+async function isOkWs($asai, hostdir, ws2, _req, hostcfg) {
   const [us, , tk] = ws2.Userinfo || [];
   if (!us) {
     ws2.close();
     return false;
   }
-  if (us !== "asai" && _optionalChain([$asai, 'access', _121 => _121.connectionsws, 'access', _122 => _122[hostdir], 'optionalAccess', _123 => _123[us]])) {
+  if (us !== "asai" && _optionalChain([$asai, 'access', _137 => _137.connectionsws, 'access', _138 => _138[hostdir], 'optionalAccess', _139 => _139[us]])) {
     const existingWs = $asai.connectionsws[hostdir][us];
-    if (_optionalChain([existingWs, 'optionalAccess', _124 => _124.Userinfo, 'optionalAccess', _125 => _125[2]]) === tk) {
+    if (_optionalChain([existingWs, 'optionalAccess', _140 => _140.Userinfo, 'optionalAccess', _141 => _141[2]]) === tk) {
       if (isWsStillActive(existingWs)) {
         rejectIncomingWs(ws2, {
           lang: "pageworking",
@@ -1048,22 +1115,26 @@ function isOkWs($asai, hostdir, ws2, _req, hostcfg) {
       }
       try {
         existingWs.close();
-      } catch (e22) {
+      } catch (e26) {
       }
       delete $asai.connectionsws[hostdir][us];
       return true;
     }
-    rejectIncomingWs(ws2, {
-      lang: "logged",
-      langpm: `${us}`,
-      con: `${us} logged in!`
-    });
-    return false;
+    const cleared = await clearStaleWsIfDead($asai, hostdir, us, existingWs);
+    if (!cleared) {
+      rejectIncomingWs(ws2, {
+        lang: "logged",
+        langpm: `${us}`,
+        con: `${us} logged in!`
+      });
+      return false;
+    }
+    return true;
   }
   if (us !== "asai") {
     const connections = $asai.connectionsws[hostdir] || {};
     const sameTkWs = Object.values(connections).find(
-      (item) => _optionalChain([item, 'access', _126 => _126.Userinfo, 'optionalAccess', _127 => _127[2]]) === tk && _optionalChain([item, 'access', _128 => _128.Userinfo, 'optionalAccess', _129 => _129[0]]) !== us
+      (item) => _optionalChain([item, 'access', _142 => _142.Userinfo, 'optionalAccess', _143 => _143[2]]) === tk && _optionalChain([item, 'access', _144 => _144.Userinfo, 'optionalAccess', _145 => _145[0]]) !== us
     );
     const maxOnline = hostcfg.maxonline || 100;
     if (sameTkWs) {
@@ -1097,15 +1168,15 @@ function loginWs($asai, hostdir, ws2, req, hostcfg, wsWorkHandler, logWsMessage)
   }
   ws2.on("message", (msg) => {
     if (logWsMessage) $asai.$log("WS", "message", msg.toString());
-    _optionalChain([wsWorkHandler, 'optionalCall', _130 => _130(msg, ws2, hostdir, req)]);
+    _optionalChain([wsWorkHandler, 'optionalCall', _146 => _146(msg, ws2, hostdir, req)]);
   });
   ws2.on("close", () => {
-    const token = _optionalChain([ws2, 'access', _131 => _131.Userinfo, 'optionalAccess', _132 => _132[2]]);
+    const token = _optionalChain([ws2, 'access', _147 => _147.Userinfo, 'optionalAccess', _148 => _148[2]]);
     if (hostcfg.ckws && ws2.tasksws) {
       Object.values(ws2.tasksws).forEach((el) => el && clearInterval(el));
       ws2.tasksws = void 0;
     }
-    if (us && _optionalChain([$asai, 'access', _133 => _133.connectionsws, 'access', _134 => _134[hostdir], 'optionalAccess', _135 => _135[us]]) === ws2) delete $asai.connectionsws[hostdir][us];
+    if (us && _optionalChain([$asai, 'access', _149 => _149.connectionsws, 'access', _150 => _150[hostdir], 'optionalAccess', _151 => _151[us]]) === ws2) delete $asai.connectionsws[hostdir][us];
     if (us && token && !isUserOnlineOnWs($asai, us, hostdir)) {
       void removeSessionOnWsClose($asai, us, String(token));
     }
@@ -1129,7 +1200,7 @@ _chunkSMVZ3ZDJcjs.__name.call(void 0, clearWsServerTasks, "clearWsServerTasks");
 function resWsMsg(msg, $asai) {
   if (msg === "ping" || msg === "pong") return msg;
   if (typeof msg !== "object" || msg === null) return msg;
-  if ((_optionalChain([msg, 'optionalAccess', _136 => _136.aes]) || _optionalChain([$asai, 'access', _137 => _137.$lib, 'access', _138 => _138.aesfns, 'optionalAccess', _139 => _139.allaes])) && _optionalChain([msg, 'optionalAccess', _140 => _140.db]) && _optionalChain([$asai, 'access', _141 => _141.$lib, 'optionalAccess', _142 => _142.aesfns, 'optionalAccess', _143 => _143.resAES])) {
+  if ((_optionalChain([msg, 'optionalAccess', _152 => _152.aes]) || _optionalChain([$asai, 'access', _153 => _153.$lib, 'access', _154 => _154.aesfns, 'optionalAccess', _155 => _155.allaes])) && _optionalChain([msg, 'optionalAccess', _156 => _156.db]) && _optionalChain([$asai, 'access', _157 => _157.$lib, 'optionalAccess', _158 => _158.aesfns, 'optionalAccess', _159 => _159.resAES])) {
     msg.db = $asai.$lib.aesfns.resAES(msg.db);
   }
   return JSON.stringify(msg);
@@ -1151,7 +1222,7 @@ function attachWssHelpers(wss, $asai) {
   wss.broadws = (msg) => {
     const data = resWsMsg(msg, $asai);
     wss.clients.forEach((client) => {
-      if (_optionalChain([client, 'optionalAccess', _144 => _144.readyState]) === _ws.WebSocket.OPEN) client.send(data);
+      if (_optionalChain([client, 'optionalAccess', _160 => _160.readyState]) === _ws.WebSocket.OPEN) client.send(data);
     });
   };
 }
@@ -1164,7 +1235,7 @@ var apiPerIp = /* @__PURE__ */ new Map();
 var apiRatePerIp = /* @__PURE__ */ new Map();
 var wsPerIp = /* @__PURE__ */ new Map();
 function getQuota($asai) {
-  return _optionalChain([$asai, 'optionalAccess', _145 => _145.hostconfig, 'optionalAccess', _146 => _146.security, 'optionalAccess', _147 => _147.quota]) || {};
+  return _optionalChain([$asai, 'optionalAccess', _161 => _161.hostconfig, 'optionalAccess', _162 => _162.security, 'optionalAccess', _163 => _163.quota]) || {};
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, getQuota, "getQuota");
 function isEnabled($asai) {
@@ -1254,7 +1325,7 @@ function getMaxWebConnections($asai, hostcfg) {
   const q = getQuota($asai);
   const fromQuota = Number(q.maxWebConnections);
   if (fromQuota > 0) return fromQuota;
-  return Number(_optionalChain([hostcfg, 'optionalAccess', _148 => _148.maxws])) > 0 ? Number(hostcfg.maxws) : 100;
+  return Number(_optionalChain([hostcfg, 'optionalAccess', _164 => _164.maxws])) > 0 ? Number(hostcfg.maxws) : 100;
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, getMaxWebConnections, "getMaxWebConnections");
 function countActiveWsConnections(wss, incoming, $asai, hostdir, hostcfg, userinfo) {
@@ -1264,12 +1335,12 @@ function countActiveWsConnections(wss, incoming, $asai, hostdir, hostcfg, userin
     if (client === incoming) continue;
     if (client.readyState === _ws.WebSocket.CLOSED || client.readyState === _ws.WebSocket.CLOSING) continue;
     const cInfo = client.Userinfo;
-    const cUs = _optionalChain([cInfo, 'optionalAccess', _149 => _149[0]]);
-    const cTk = _optionalChain([cInfo, 'optionalAccess', _150 => _150[2]]);
+    const cUs = _optionalChain([cInfo, 'optionalAccess', _165 => _165[0]]);
+    const cTk = _optionalChain([cInfo, 'optionalAccess', _166 => _166[2]]);
     if (us && tk && cUs === us && cTk === tk) continue;
-    if (_optionalChain([hostcfg, 'optionalAccess', _151 => _151.ckws]) && us && tk) {
-      const existing = _optionalChain([$asai, 'optionalAccess', _152 => _152.connectionsws, 'optionalAccess', _153 => _153[hostdir], 'optionalAccess', _154 => _154[us]]);
-      if (existing === client && _optionalChain([existing, 'optionalAccess', _155 => _155.Userinfo, 'optionalAccess', _156 => _156[2]]) === tk) continue;
+    if (_optionalChain([hostcfg, 'optionalAccess', _167 => _167.ckws]) && us && tk) {
+      const existing = _optionalChain([$asai, 'optionalAccess', _168 => _168.connectionsws, 'optionalAccess', _169 => _169[hostdir], 'optionalAccess', _170 => _170[us]]);
+      if (existing === client && _optionalChain([existing, 'optionalAccess', _171 => _171.Userinfo, 'optionalAccess', _172 => _172[2]]) === tk) continue;
     }
     count += 1;
   }
@@ -1281,7 +1352,7 @@ _chunkSMVZ3ZDJcjs.__name.call(void 0, countActiveWsConnections, "countActiveWsCo
 function createWSHost($asai, hostdir) {
   const hostcfg = getHostCFG(hostdir, $asai);
   const wsWorkHandler = getWorkHandler("wsWork");
-  const logWsMessage = !!_optionalChain([$asai, 'access', _157 => _157.hostconfig, 'access', _158 => _158.logger, 'optionalAccess', _159 => _159.lv, 'optionalAccess', _160 => _160.view]);
+  const logWsMessage = !!_optionalChain([$asai, 'access', _173 => _173.hostconfig, 'access', _174 => _174.logger, 'optionalAccess', _175 => _175.lv, 'optionalAccess', _176 => _176.view]);
   try {
     if ($asai.serversws[hostdir]) return;
     if (hostcfg.ckws && !$asai.connectionsws[hostdir]) {
@@ -1293,14 +1364,14 @@ function createWSHost($asai, hostdir) {
     wss.on("error", (err) => {
       clearWsServerTasks($asai, hostdir);
       $asai.$log("WS", "WS    Server error!", err);
-      _optionalChain([wss, 'access', _161 => _161.close, 'optionalCall', _162 => _162(() => {
+      _optionalChain([wss, 'access', _177 => _177.close, 'optionalCall', _178 => _178(() => {
         $asai.$log("WS", "WS    Server closed");
         delete $asai.serversws[hostdir];
       })]);
     });
     wss.on("close", (code, reason) => {
       try {
-        $asai.$log("WS", `WebSocket closed, server ${hostdir}, code: ${code}, reason: ${_optionalChain([reason, 'optionalAccess', _163 => _163.toString, 'call', _164 => _164()])}`);
+        $asai.$log("WS", `WebSocket closed, server ${hostdir}, code: ${code}, reason: ${_optionalChain([reason, 'optionalAccess', _179 => _179.toString, 'call', _180 => _180()])}`);
         clearWsServerTasks($asai, hostdir);
       } catch (err) {
         $asai.$log("WS", "WS close handler error:", err);
@@ -1331,12 +1402,14 @@ function createWSHost($asai, hostdir) {
         ws2.send(wsmsg, () => ws2.close(1013, "Server busy"));
         return;
       }
-      const isOpen = !hostcfg.ckws || isOkWs($asai, hostdir, ws2, req, hostcfg);
-      if (isOpen) {
-        loginWs($asai, hostdir, ws2, req, hostcfg, wsWorkHandler, logWsMessage);
-      } else {
-        ws2.close();
-      }
+      void (async () => {
+        const isOpen = !hostcfg.ckws || await isOkWs($asai, hostdir, ws2, req, hostcfg);
+        if (isOpen) {
+          loginWs($asai, hostdir, ws2, req, hostcfg, wsWorkHandler, logWsMessage);
+        } else {
+          ws2.close();
+        }
+      })();
     });
     $asai.serversws[hostdir] = wss;
   } catch (err) {
@@ -1388,7 +1461,7 @@ var StaticPathCache = class {
       const stat = fs3.statSync(entry.filePath);
       if (!stat.isFile() || stat.mtimeMs !== entry.mtimeMs) return null;
       return stat;
-    } catch (e23) {
+    } catch (e27) {
       return null;
     }
   }
@@ -1407,8 +1480,8 @@ function applySecurityHeaders(res, isHttps = false, hostconfig) {
   if (isHttps) {
     res.setHeader("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
   }
-  const sec = _optionalChain([hostconfig, 'optionalAccess', _165 => _165.security]);
-  if (_optionalChain([sec, 'optionalAccess', _166 => _166.csp])) {
+  const sec = _optionalChain([hostconfig, 'optionalAccess', _181 => _181.security]);
+  if (_optionalChain([sec, 'optionalAccess', _182 => _182.csp])) {
     const csp = typeof sec.cspPolicy === "string" && sec.cspPolicy.length > 0 ? sec.cspPolicy : DEFAULT_CSP;
     res.setHeader("Content-Security-Policy", csp);
   }
@@ -1416,9 +1489,9 @@ function applySecurityHeaders(res, isHttps = false, hostconfig) {
 _chunkSMVZ3ZDJcjs.__name.call(void 0, applySecurityHeaders, "applySecurityHeaders");
 function getHttpUserinfo(req, $asai) {
   try {
-    const userinfo = _optionalChain([req, 'access', _167 => _167.headers, 'optionalAccess', _168 => _168["userinfo"], 'optionalAccess', _169 => _169.split, 'call', _170 => _170("##")]);
+    const userinfo = _optionalChain([req, 'access', _183 => _183.headers, 'optionalAccess', _184 => _184["userinfo"], 'optionalAccess', _185 => _185.split, 'call', _186 => _186("##")]);
     return deUserInfoWithAsai(userinfo, $asai);
-  } catch (e24) {
+  } catch (e28) {
     return "";
   }
 }
@@ -1449,7 +1522,7 @@ function normalizeRequestPath(url) {
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, normalizeRequestPath, "normalizeRequestPath");
 function createSkipChecker($asai) {
-  const skip = _optionalChain([$asai, 'access', _171 => _171.hostconfig, 'optionalAccess', _172 => _172.logger, 'optionalAccess', _173 => _173.skip]);
+  const skip = _optionalChain([$asai, 'access', _187 => _187.hostconfig, 'optionalAccess', _188 => _188.logger, 'optionalAccess', _189 => _189.skip]);
   if (!Array.isArray(skip) || skip.length === 0) return () => false;
   const exact = /* @__PURE__ */ new Set();
   const prefixes = [];
@@ -1485,7 +1558,7 @@ function attachAccessLog($asai, req, res, logType) {
     try {
       const entry = _chunkOCEBEEP5cjs.buildAccessEntry.call(void 0, req, res, logType);
       void $asai.appendAccessLog(_chunkOCEBEEP5cjs.formatCLF.call(void 0, entry), _chunkOCEBEEP5cjs.formatW3CAccessRecord.call(void 0, entry));
-    } catch (e25) {
+    } catch (e29) {
     }
   }, "onFinish");
   if (res.writableEnded || res.finished) onFinish();
@@ -1544,7 +1617,7 @@ function findExistingFileUnderRoots(requestedPath, allowedRoots) {
       if (stat.isFile()) {
         return { filePath: absTarget, stat };
       }
-    } catch (e26) {
+    } catch (e30) {
     }
   }
   return null;
@@ -1557,13 +1630,13 @@ function getHostAllowedRoots(hostconfig) {
     try {
       const abs = path2.resolve("./" + dir.replace(/\\/g, "/"));
       if (fs4.existsSync(abs)) roots.add(abs);
-    } catch (e27) {
+    } catch (e31) {
     }
   }, "push");
-  for (const dir of _optionalChain([hostconfig, 'optionalAccess', _174 => _174.hostdirs]) || []) push(dir);
+  for (const dir of _optionalChain([hostconfig, 'optionalAccess', _190 => _190.hostdirs]) || []) push(dir);
   push("webdata");
   push("websys");
-  if (_optionalChain([hostconfig, 'optionalAccess', _175 => _175.weburls, 'optionalAccess', _176 => _176.webdir])) push(hostconfig.weburls.webdir);
+  if (_optionalChain([hostconfig, 'optionalAccess', _191 => _191.weburls, 'optionalAccess', _192 => _192.webdir])) push(hostconfig.weburls.webdir);
   const result = [];
   roots.forEach((r) => result.push(r));
   return result;
@@ -1594,7 +1667,7 @@ function getStaticBaseDirs($asai) {
 _chunkSMVZ3ZDJcjs.__name.call(void 0, getStaticBaseDirs, "getStaticBaseDirs");
 function shouldForceHostdirs($asai) {
   if ($asai.pkgSnapshotDir) return true;
-  return _optionalChain([$asai, 'access', _177 => _177.hostconfig, 'optionalAccess', _178 => _178.pkg, 'optionalAccess', _179 => _179.type]) === 1;
+  return _optionalChain([$asai, 'access', _193 => _193.hostconfig, 'optionalAccess', _194 => _194.pkg, 'optionalAccess', _195 => _195.type]) === 1;
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, shouldForceHostdirs, "shouldForceHostdirs");
 function buildStaticSearchDirs(hostcfg, $asai) {
@@ -1615,12 +1688,12 @@ function buildStaticSearchDirs(hostcfg, $asai) {
           ordered.push(dir);
           return;
         }
-      } catch (e28) {
+      } catch (e32) {
       }
     }
   }, "pushDir");
   for (const dir of hostcfg.hostdirs || []) pushDir(dir);
-  if (_optionalChain([hostcfg, 'access', _180 => _180.weburls, 'optionalAccess', _181 => _181.webdir])) pushDir(hostcfg.weburls.webdir);
+  if (_optionalChain([hostcfg, 'access', _196 => _196.weburls, 'optionalAccess', _197 => _197.webdir])) pushDir(hostcfg.weburls.webdir);
   return ordered;
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, buildStaticSearchDirs, "buildStaticSearchDirs");
@@ -1648,7 +1721,7 @@ function parseUrlPath(requrl) {
     if (!requrl) return "/";
     const safeUrl = requrl.startsWith("http") ? requrl : encodeURI(requrl);
     return new URL(safeUrl, "http://localhost").pathname;
-  } catch (e29) {
+  } catch (e33) {
     return requrl;
   }
 }
@@ -1747,8 +1820,8 @@ function serveStaticFile(req, res, foundPath, mimeType, stat, $asai, urlPath = "
 _chunkSMVZ3ZDJcjs.__name.call(void 0, serveStaticFile, "serveStaticFile");
 function createStaticHandler(ctx) {
   const { hostcfg, hostdir, indexFile, $asai, staticPathCache } = ctx;
-  const hasRewrite = !!(_optionalChain([hostcfg, 'access', _182 => _182.weburls, 'optionalAccess', _183 => _183.rewrite]) && _optionalChain([hostcfg, 'access', _184 => _184.weburls, 'optionalAccess', _185 => _185.webdir]) && _optionalChain([hostcfg, 'access', _186 => _186.weburls, 'optionalAccess', _187 => _187.keys, 'optionalAccess', _188 => _188.length]));
-  const rewriteKeys = hasRewrite ? _optionalChain([hostcfg, 'access', _189 => _189.weburls, 'optionalAccess', _190 => _190.keys]) || [] : [];
+  const hasRewrite = !!(_optionalChain([hostcfg, 'access', _198 => _198.weburls, 'optionalAccess', _199 => _199.rewrite]) && _optionalChain([hostcfg, 'access', _200 => _200.weburls, 'optionalAccess', _201 => _201.webdir]) && _optionalChain([hostcfg, 'access', _202 => _202.weburls, 'optionalAccess', _203 => _203.keys, 'optionalAccess', _204 => _204.length]));
+  const rewriteKeys = hasRewrite ? _optionalChain([hostcfg, 'access', _205 => _205.weburls, 'optionalAccess', _206 => _206.keys]) || [] : [];
   const checkWebUrls = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, (rurl) => {
     if (!hasRewrite || !rurl) return false;
     for (let i = 0; i < rewriteKeys.length; i++) {
@@ -1763,7 +1836,7 @@ function createStaticHandler(ctx) {
     const roots = rhostdirs.join("|") === primaryDirs.join("|") ? buildStaticRoots(primaryDirs, $asai) : buildStaticRoots(rhostdirs, $asai);
     const findValidFile = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, (urlPath) => {
       const hit = staticPathCache.get(cacheKey);
-      if (_optionalChain([hit, 'optionalAccess', _191 => _191.is404])) return null;
+      if (_optionalChain([hit, 'optionalAccess', _207 => _207.is404])) return null;
       if (hit && !hit.is404) {
         const verified = staticPathCache.verify(hit);
         if (verified) return { filePath: hit.filePath, stat: verified };
@@ -1787,7 +1860,7 @@ function createStaticHandler(ctx) {
       showHostDirs(req, res, [hostcfg.weburls.webdir], "/" + indexFile, primaryDirs, rtm + 1);
       return;
     }
-    const mimeType = _optionalChain([hostcfg, 'access', _192 => _192.mimetypes, 'optionalAccess', _193 => _193[nodePath2.extname(found.filePath)]]) || "application/octet-stream";
+    const mimeType = _optionalChain([hostcfg, 'access', _208 => _208.mimetypes, 'optionalAccess', _209 => _209[nodePath2.extname(found.filePath)]]) || "application/octet-stream";
     serveStaticFile(req, res, found.filePath, mimeType, found.stat, $asai, processedUrl);
   }, "showHostDirs");
   return (req, res, url) => {
@@ -1812,7 +1885,7 @@ _chunkSMVZ3ZDJcjs.__name.call(void 0, createStaticHandler, "createStaticHandler"
 function setupHttpConnectionMonitor($asai, hostdir, server, hostcfg) {
   const maxHttp = hostcfg.maxhttp || 100;
   const monitorInterval = setInterval(() => {
-    const connCount = _optionalChain([$asai, 'access', _194 => _194.connectionshttp, 'access', _195 => _195[hostdir], 'optionalAccess', _196 => _196.size]) || 0;
+    const connCount = _optionalChain([$asai, 'access', _210 => _210.connectionshttp, 'access', _211 => _211[hostdir], 'optionalAccess', _212 => _212.size]) || 0;
     if (connCount > maxHttp * 0.8) {
       $asai.$log("HTTP", `HTTP Connection HIGH (${connCount}/${maxHttp})`);
     }
@@ -1883,10 +1956,10 @@ function findListeningPids(port) {
         stdio: ["pipe", "pipe", "ignore"]
       });
       return out.split(/\r?\n/).map((s) => parseInt(s.trim(), 10)).filter((n) => n > 0);
-    } catch (e30) {
+    } catch (e34) {
       return [];
     }
-  } catch (e31) {
+  } catch (e35) {
     return [];
   }
 }
@@ -1897,10 +1970,10 @@ function formatOccupants(port, exclude) {
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, formatOccupants, "formatOccupants");
 function releasePort(port, opts) {
-  const exclude = _nullishCoalesce(_optionalChain([opts, 'optionalAccess', _197 => _197.excludePid]), () => ( OWN_PID));
+  const exclude = _nullishCoalesce(_optionalChain([opts, 'optionalAccess', _213 => _213.excludePid]), () => ( OWN_PID));
   const occupants = formatOccupants(port, exclude);
   if (!occupants) return true;
-  const label = _optionalChain([opts, 'optionalAccess', _198 => _198.label]) ? `[${opts.label}] ` : "";
+  const label = _optionalChain([opts, 'optionalAccess', _214 => _214.label]) ? `[${opts.label}] ` : "";
   console.warn(
     `[AsaiHostNodejs] ${label}\u7AEF\u53E3 ${port} \u88AB\u5360\u7528\uFF08PID: ${occupants}\uFF09\uFF0C\u8BF7\u624B\u52A8\u7ED3\u675F\u5360\u7528\u8FDB\u7A0B\u540E\u91CD\u8BD5`
   );
@@ -1909,23 +1982,23 @@ function releasePort(port, opts) {
 _chunkSMVZ3ZDJcjs.__name.call(void 0, releasePort, "releasePort");
 function collectStartupPorts($asai) {
   const ports = /* @__PURE__ */ new Set();
-  const hosts = _optionalChain([$asai, 'access', _199 => _199.hostconfig, 'optionalAccess', _200 => _200.hosts]);
+  const hosts = _optionalChain([$asai, 'access', _215 => _215.hostconfig, 'optionalAccess', _216 => _216.hosts]);
   if (hosts) {
     for (const el of Object.keys(hosts)) {
       if (el === "default") continue;
       if (el !== "asai" && !validateHostdir(el)) continue;
       const cfg = getHostCFG(el, $asai);
-      if (_optionalChain([cfg, 'optionalAccess', _201 => _201.close])) continue;
-      if (_optionalChain([cfg, 'optionalAccess', _202 => _202.port])) ports.add(Number(cfg.port));
+      if (_optionalChain([cfg, 'optionalAccess', _217 => _217.close])) continue;
+      if (_optionalChain([cfg, 'optionalAccess', _218 => _218.port])) ports.add(Number(cfg.port));
     }
   }
-  const proxyhosts = _optionalChain([$asai, 'access', _203 => _203.hostconfig, 'optionalAccess', _204 => _204.proxyhosts]);
+  const proxyhosts = _optionalChain([$asai, 'access', _219 => _219.hostconfig, 'optionalAccess', _220 => _220.proxyhosts]);
   if (proxyhosts) {
     for (const el of Object.keys(proxyhosts)) {
       if (el === "default") continue;
       if (!validateHostdir(el)) continue;
       const cfg = getProxyHostCFG(el, $asai);
-      if (_optionalChain([cfg, 'optionalAccess', _205 => _205.proxyport])) ports.add(Number(cfg.proxyport));
+      if (_optionalChain([cfg, 'optionalAccess', _221 => _221.proxyport])) ports.add(Number(cfg.proxyport));
     }
   }
   return [...ports];
@@ -1950,7 +2023,7 @@ function scheduleHttpRetry($asai, hostdir) {
       clearTimeout($asai.hostconfig.guardtm);
       $asai.hostconfig.guardtm = null;
     }
-  }, _optionalChain([$asai, 'access', _206 => _206.hostconfig, 'access', _207 => _207.tm, 'optionalAccess', _208 => _208.d]) || 2e3);
+  }, _optionalChain([$asai, 'access', _222 => _222.hostconfig, 'access', _223 => _223.tm, 'optionalAccess', _224 => _224.d]) || 2e3);
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, scheduleHttpRetry, "scheduleHttpRetry");
 function clearFailedHttpHost($asai, hostdir, ws2) {
@@ -1963,7 +2036,7 @@ function getHTTPServer(httptype = "", cfg, $asai) {
     if (httptype.startsWith("https")) {
       return {
         AsCreateServer: /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, (callback) => {
-          return https.createServer(_optionalChain([cfg, 'optionalAccess', _209 => _209.httpscert]) || $asai.hostconfig.httpscert, callback);
+          return https.createServer(_optionalChain([cfg, 'optionalAccess', _225 => _225.httpscert]) || $asai.hostconfig.httpscert, callback);
         }, "AsCreateServer"),
         Agent: https.Agent,
         request: https.request
@@ -2015,13 +2088,13 @@ function startHTTPServer($asai, hostdir) {
             return;
           }
           applySecurityHeaders(res, isHttps, $asai.hostconfig);
-          if (_optionalChain([req, 'access', _210 => _210.url, 'optionalAccess', _211 => _211.startsWith, 'call', _212 => _212("/sys")]) && sysWork) {
+          if (_optionalChain([req, 'access', _226 => _226.url, 'optionalAccess', _227 => _227.startsWith, 'call', _228 => _228("/sys")]) && sysWork) {
             logHttp($asai, "SYS", req.method, req.url, skipChecker, req, res);
             sysWork(req, res, hostdir);
-          } else if (_optionalChain([req, 'access', _213 => _213.url, 'optionalAccess', _214 => _214.startsWith, 'call', _215 => _215("/api")]) && apiWork) {
+          } else if (_optionalChain([req, 'access', _229 => _229.url, 'optionalAccess', _230 => _230.startsWith, 'call', _231 => _231("/api")]) && apiWork) {
             logHttp($asai, "API", req.method, req.url, skipChecker, req, res);
             apiWork(req, res, hostdir);
-          } else if (_optionalChain([req, 'access', _216 => _216.url, 'optionalAccess', _217 => _217.startsWith, 'call', _218 => _218("/jsonp")]) && jsonpWork) {
+          } else if (_optionalChain([req, 'access', _232 => _232.url, 'optionalAccess', _233 => _233.startsWith, 'call', _234 => _234("/jsonp")]) && jsonpWork) {
             logHttp($asai, "JSONP", req.method, req.url, skipChecker, req, res);
             jsonpWork(req, res, hostdir);
           } else if (handleStatic) {
@@ -2092,7 +2165,7 @@ function findSameProcessPortOwner($asai, port, excludeHostdir) {
   for (const hostdir of Object.keys($asai.servershttp || {})) {
     if (hostdir === excludeHostdir) continue;
     const cfg = getHostCFG(hostdir, $asai);
-    if (_optionalChain([cfg, 'optionalAccess', _219 => _219.port]) === port) return hostdir;
+    if (_optionalChain([cfg, 'optionalAccess', _235 => _235.port]) === port) return hostdir;
   }
   return null;
 }
@@ -2100,7 +2173,7 @@ _chunkSMVZ3ZDJcjs.__name.call(void 0, findSameProcessPortOwner, "findSameProcess
 function asaiGuard($asai, failedHostdir = "asai") {
   const conflictPorts = $asai.hostconfig.asaiport || [];
   const hostcfg = getHostCFG(failedHostdir, $asai);
-  const port = _optionalChain([hostcfg, 'optionalAccess', _220 => _220.port]);
+  const port = _optionalChain([hostcfg, 'optionalAccess', _236 => _236.port]);
   if (!port || !conflictPorts.includes(port)) {
     scheduleHttpRetry($asai, failedHostdir);
     return;
@@ -2132,7 +2205,7 @@ var PROXY_SKIP_HEADERS = /* @__PURE__ */ new Set([
 function startProxyServer($asai, proxyhostdir) {
   const proxycfg = getProxyHostCFG(proxyhostdir, $asai);
   if (!proxycfg.url) return;
-  if (_optionalChain([$asai, 'access', _221 => _221.serversproxy, 'optionalAccess', _222 => _222[proxyhostdir]])) return;
+  if (_optionalChain([$asai, 'access', _237 => _237.serversproxy, 'optionalAccess', _238 => _238[proxyhostdir]])) return;
   try {
     const httpServer = getHTTPServer(proxycfg.proxyhttptype, proxycfg, $asai);
     const targetHttp = getHTTPServer(proxycfg.url, proxycfg, $asai);
@@ -2214,12 +2287,12 @@ function startProxyServer($asai, proxyhostdir) {
     proxyServer.on("error", (err) => {
       if (err.code === "EADDRINUSE") {
         $asai.$log("PROXY", `\x1B[41mPort ${proxycfg.proxyport} is already start!\x1B[0m`);
-         _optionalChainDelete([$asai, 'access', _223 => _223.serversproxy, 'optionalAccess', _224 => delete _224[proxyhostdir]]);
+         _optionalChainDelete([$asai, 'access', _239 => _239.serversproxy, 'optionalAccess', _240 => delete _240[proxyhostdir]]);
         releasePort(proxycfg.proxyport, {
           excludePid: process.pid,
           label: proxyhostdir
         });
-        setTimeout(() => startProxyServer($asai, proxyhostdir), _optionalChain([$asai, 'access', _225 => _225.hostconfig, 'access', _226 => _226.tm, 'optionalAccess', _227 => _227.d]) || 2e3);
+        setTimeout(() => startProxyServer($asai, proxyhostdir), _optionalChain([$asai, 'access', _241 => _241.hostconfig, 'access', _242 => _242.tm, 'optionalAccess', _243 => _243.d]) || 2e3);
       } else {
         $asai.$log("PROXY", "Proxy server error:", err);
       }
@@ -2259,7 +2332,7 @@ function src_default($asai, opt) {
     initAsaiHostNodejs($asai, opt);
     console.log(`\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B\u203B`);
     releaseConfiguredPorts($asai);
-    if (_optionalChain([$asai, 'access', _228 => _228.hostconfig, 'optionalAccess', _229 => _229.hosts])) {
+    if (_optionalChain([$asai, 'access', _244 => _244.hostconfig, 'optionalAccess', _245 => _245.hosts])) {
       $asai.startHTTPServer = (hostdir) => startHTTPServer($asai, hostdir);
       Object.keys($asai.hostconfig.hosts).forEach((el) => {
         if (validateHostdir(el)) {
@@ -2270,7 +2343,7 @@ function src_default($asai, opt) {
         startHTTPServer($asai, "asai");
       }
     }
-    if (_optionalChain([$asai, 'access', _230 => _230.hostconfig, 'optionalAccess', _231 => _231.proxyhosts])) {
+    if (_optionalChain([$asai, 'access', _246 => _246.hostconfig, 'optionalAccess', _247 => _247.proxyhosts])) {
       Object.keys($asai.hostconfig.proxyhosts).forEach((el) => {
         if (validateHostdir(el)) {
           startProxyServer($asai, el);
@@ -2293,22 +2366,22 @@ _chunkSMVZ3ZDJcjs.__export.call(void 0, utils_exports, {
 // src/utils/ws-mock.ts
 function wsMock($asai) {
   function getKeyByData(reqdata, hostdir) {
-    return "_wstask_" + (hostdir || "") + "_" + (_optionalChain([reqdata, 'optionalAccess', _232 => _232.id]) || _optionalChain([reqdata, 'optionalAccess', _233 => _233.ty]) + "." + _optionalChain([reqdata, 'optionalAccess', _234 => _234.ac]));
+    return "_wstask_" + (hostdir || "") + "_" + (_optionalChain([reqdata, 'optionalAccess', _248 => _248.id]) || _optionalChain([reqdata, 'optionalAccess', _249 => _249.ty]) + "." + _optionalChain([reqdata, 'optionalAccess', _250 => _250.ac]));
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, getKeyByData, "getKeyByData");
   function getMockDb(workopt) {
     const { reqdata, mockdata } = workopt;
-    const wsfn = _optionalChain([mockdata, 'optionalAccess', _235 => _235.fn]) ? _optionalChain([$asai, 'access', _236 => _236.asaimock, 'access', _237 => _237.fn, 'optionalAccess', _238 => _238[mockdata.fn]]) : null;
+    const wsfn = _optionalChain([mockdata, 'optionalAccess', _251 => _251.fn]) ? _optionalChain([$asai, 'access', _252 => _252.asaimock, 'access', _253 => _253.fn, 'optionalAccess', _254 => _254[mockdata.fn]]) : null;
     if (wsfn) return wsfn({ workopt, $asai, mockName: mockdata.fn });
     return { ...reqdata, ...mockdata || {} };
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, getMockDb, "getMockDb");
   function wsWorkApi(workopt) {
-    _optionalChain([$asai, 'access', _239 => _239.serversws, 'access', _240 => _240[workopt.hostdir], 'optionalAccess', _241 => _241.sendws, 'optionalCall', _242 => _242(workopt.reqdataisobj ? getMockDb(workopt) : workopt.reqdata, 0, workopt.ws)]);
+    _optionalChain([$asai, 'access', _255 => _255.serversws, 'access', _256 => _256[workopt.hostdir], 'optionalAccess', _257 => _257.sendws, 'optionalCall', _258 => _258(workopt.reqdataisobj ? getMockDb(workopt) : workopt.reqdata, 0, workopt.ws)]);
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, wsWorkApi, "wsWorkApi");
   function wsWorkListen(workopt, reqkey) {
-    if (_optionalChain([workopt, 'access', _243 => _243.reqdata, 'optionalAccess', _244 => _244.off])) {
+    if (_optionalChain([workopt, 'access', _259 => _259.reqdata, 'optionalAccess', _260 => _260.off])) {
       if ($asai.tasksws[workopt.hostdir][reqkey]) {
         clearInterval($asai.tasksws[workopt.hostdir][reqkey]);
         $asai.tasksws[workopt.hostdir][reqkey] = null;
@@ -2323,9 +2396,9 @@ function wsMock($asai) {
       if (!$asai.tasksws[workopt.hostdir][reqkey]) {
         clearInterval($asai.tasksws[workopt.hostdir][reqkey]);
       }
-    }, _optionalChain([newDataMock, 'optionalAccess', _245 => _245.tc]) || 2e3);
-    _optionalChain([workopt, 'access', _246 => _246.ws, 'optionalAccess', _247 => _247.once, 'optionalCall', _248 => _248("close", () => {
-      if (_optionalChain([$asai, 'access', _249 => _249.tasksws, 'access', _250 => _250[workopt.hostdir], 'optionalAccess', _251 => _251[reqkey]])) {
+    }, _optionalChain([newDataMock, 'optionalAccess', _261 => _261.tc]) || 2e3);
+    _optionalChain([workopt, 'access', _262 => _262.ws, 'optionalAccess', _263 => _263.once, 'optionalCall', _264 => _264("close", () => {
+      if (_optionalChain([$asai, 'access', _265 => _265.tasksws, 'access', _266 => _266[workopt.hostdir], 'optionalAccess', _267 => _267[reqkey]])) {
         clearInterval($asai.tasksws[workopt.hostdir][reqkey]);
         delete $asai.tasksws[workopt.hostdir][reqkey];
       }
@@ -2333,8 +2406,8 @@ function wsMock($asai) {
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, wsWorkListen, "wsWorkListen");
   function wsWorkMock(workopt) {
-    workopt.mockdata = workopt.reqdataisobj && _optionalChain([$asai, 'access', _252 => _252.asaimock, 'optionalAccess', _253 => _253.db, 'optionalAccess', _254 => _254[workopt.hostdir], 'optionalAccess', _255 => _255[_optionalChain([workopt, 'access', _256 => _256.reqdata, 'optionalAccess', _257 => _257.ty])]]) || {};
-    if (_optionalChain([workopt, 'access', _258 => _258.mockdata, 'optionalAccess', _259 => _259.wc])) {
+    workopt.mockdata = workopt.reqdataisobj && _optionalChain([$asai, 'access', _268 => _268.asaimock, 'optionalAccess', _269 => _269.db, 'optionalAccess', _270 => _270[workopt.hostdir], 'optionalAccess', _271 => _271[_optionalChain([workopt, 'access', _272 => _272.reqdata, 'optionalAccess', _273 => _273.ty])]]) || {};
+    if (_optionalChain([workopt, 'access', _274 => _274.mockdata, 'optionalAccess', _275 => _275.wc])) {
       wsWorkListen(workopt, getKeyByData(workopt.reqdata, workopt.hostdir));
     } else {
       wsWorkApi(workopt);
@@ -2347,7 +2420,7 @@ _chunkSMVZ3ZDJcjs.__name.call(void 0, wsMock, "wsMock");
 
 // src/infra/user-auth.ts
 async function attachServerUserLevel(req, $asai) {
-  const userinfo = _optionalChain([req, 'optionalAccess', _260 => _260.Userinfo]);
+  const userinfo = _optionalChain([req, 'optionalAccess', _276 => _276.Userinfo]);
   if (!Array.isArray(userinfo) || !userinfo[0]) return;
   const us = String(userinfo[0]);
   try {
@@ -2359,27 +2432,27 @@ async function attachServerUserLevel(req, $asai) {
     } else {
       req._serverUser = null;
     }
-  } catch (e32) {
+  } catch (e36) {
     req._serverUser = null;
   }
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, attachServerUserLevel, "attachServerUserLevel");
 function getRequestUserLevel(req) {
-  if (_optionalChain([req, 'optionalAccess', _261 => _261._serverUser, 'optionalAccess', _262 => _262.lv]) != null) return Number(req._serverUser.lv);
-  const n = Number(_nullishCoalesce(_optionalChain([req, 'optionalAccess', _263 => _263.Userinfo, 'optionalAccess', _264 => _264[1]]), () => ( -1)));
+  if (_optionalChain([req, 'optionalAccess', _277 => _277._serverUser, 'optionalAccess', _278 => _278.lv]) != null) return Number(req._serverUser.lv);
+  const n = Number(_nullishCoalesce(_optionalChain([req, 'optionalAccess', _279 => _279.Userinfo, 'optionalAccess', _280 => _280[1]]), () => ( -1)));
   return Number.isFinite(n) ? n : -1;
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, getRequestUserLevel, "getRequestUserLevel");
 function getRequestUsername(req) {
-  if (_optionalChain([req, 'optionalAccess', _265 => _265._serverUser, 'optionalAccess', _266 => _266.us])) return String(req._serverUser.us);
-  const us = _optionalChain([req, 'optionalAccess', _267 => _267.Userinfo, 'optionalAccess', _268 => _268[0]]);
+  if (_optionalChain([req, 'optionalAccess', _281 => _281._serverUser, 'optionalAccess', _282 => _282.us])) return String(req._serverUser.us);
+  const us = _optionalChain([req, 'optionalAccess', _283 => _283.Userinfo, 'optionalAccess', _284 => _284[0]]);
   return us ? String(us) : void 0;
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, getRequestUsername, "getRequestUsername");
 
 // src/infra/access-control.ts
 function getSecurityConfig($asai) {
-  return _optionalChain([$asai, 'optionalAccess', _269 => _269.hostconfig, 'optionalAccess', _270 => _270.security]) || {};
+  return _optionalChain([$asai, 'optionalAccess', _285 => _285.hostconfig, 'optionalAccess', _286 => _286.security]) || {};
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, getSecurityConfig, "getSecurityConfig");
 function pathMatchesPattern(path8, pattern) {
@@ -2413,13 +2486,13 @@ function validateHttpAuth(req, $asai, pathname) {
   if (!isAuthRequired($asai, pathname)) {
     return { ok: true };
   }
-  const userinfo = _optionalChain([req, 'optionalAccess', _271 => _271.Userinfo]);
+  const userinfo = _optionalChain([req, 'optionalAccess', _287 => _287.Userinfo]);
   const ip = getClientIp(req);
   if (!Array.isArray(userinfo) || userinfo.length < 3 || !userinfo[0]) {
     logSecurityEvent($asai, {
       type: "AUTH_MISSING",
       path: pathname,
-      method: _optionalChain([req, 'optionalAccess', _272 => _272.method]),
+      method: _optionalChain([req, 'optionalAccess', _288 => _288.method]),
       ip,
       detail: "Userinfo header missing or invalid"
     });
@@ -2433,7 +2506,7 @@ function validateHttpAuth(req, $asai, pathname) {
     logSecurityEvent($asai, {
       type: "ACCESS_DENIED",
       path: pathname,
-      method: _optionalChain([req, 'optionalAccess', _273 => _273.method]),
+      method: _optionalChain([req, 'optionalAccess', _289 => _289.method]),
       user: String(us),
       level: userLevel,
       ip,
@@ -2445,13 +2518,13 @@ function validateHttpAuth(req, $asai, pathname) {
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, validateHttpAuth, "validateHttpAuth");
 async function validateHttpAuthAsync(req, $asai, pathname) {
-  if (Array.isArray(_optionalChain([req, 'optionalAccess', _274 => _274.Userinfo])) && req.Userinfo[0]) {
+  if (Array.isArray(_optionalChain([req, 'optionalAccess', _290 => _290.Userinfo])) && req.Userinfo[0]) {
     await attachServerUserLevel(req, $asai);
     if (!req._serverUser && isAuthRequired($asai, pathname)) {
       logSecurityEvent($asai, {
         type: "ACCESS_DENIED",
         path: pathname,
-        method: _optionalChain([req, 'optionalAccess', _275 => _275.method]),
+        method: _optionalChain([req, 'optionalAccess', _291 => _291.method]),
         user: String(req.Userinfo[0]),
         ip: getClientIp(req),
         detail: "User not found or inactive"
@@ -2513,7 +2586,7 @@ function resolveApiCorsOrigin(req, hostcfg, getHeader) {
     if (referer) {
       try {
         origin = new URL(referer).origin;
-      } catch (e33) {
+      } catch (e37) {
         const parts = referer.split("/");
         if (parts.length >= 3) origin = `${parts[0]}//${parts[2]}`;
       }
@@ -2525,7 +2598,7 @@ _chunkSMVZ3ZDJcjs.__name.call(void 0, resolveApiCorsOrigin, "resolveApiCorsOrigi
 function isApiCorsAllowed(origin, hostcfg, hostHeader) {
   if (!origin) return false;
   if (origin === "*") return true;
-  const corsList = _optionalChain([hostcfg, 'optionalAccess', _276 => _276.cors]);
+  const corsList = _optionalChain([hostcfg, 'optionalAccess', _292 => _292.cors]);
   if (!Array.isArray(corsList) || !corsList.length) return true;
   if (corsList.includes(origin)) return true;
   if (hostHeader && origin.includes(hostHeader)) return true;
@@ -2571,19 +2644,19 @@ _chunkSMVZ3ZDJcjs.__name.call(void 0, isPlainSourcePost, "isPlainSourcePost");
 function processPostPayload($asai, req, postdata, pm) {
   let isAes = false;
   let out = postdata;
-  if ($asai.$lib.aesfns && _optionalChain([out, 'optionalAccess', _277 => _277.startsWith, 'optionalCall', _278 => _278('{"aes":')])) {
+  if ($asai.$lib.aesfns && _optionalChain([out, 'optionalAccess', _293 => _293.startsWith, 'optionalCall', _294 => _294('{"aes":')])) {
     isAes = true;
     const aesData = JSON.parse(out);
     out = $asai.$lib.aesfns.reqAES({ data: aesData });
-    if (_optionalChain([aesData, 'optionalAccess', _279 => _279.aes]) === 2 && typeof out === "string") {
+    if (_optionalChain([aesData, 'optionalAccess', _295 => _295.aes]) === 2 && typeof out === "string") {
       try {
         out = JSON.parse(out);
-      } catch (e34) {
+      } catch (e38) {
       }
     }
   }
   const plainJson = typeof out === "string" && out.trimStart().startsWith("{");
-  if (_optionalChain([req, 'optionalAccess', _280 => _280.Userinfo, 'optionalAccess', _281 => _281[2]]) && !plainJson && !isRawUploadPost(_optionalChain([req, 'optionalAccess', _282 => _282.url])) && !isPlainSourcePost(_optionalChain([req, 'optionalAccess', _283 => _283.url]))) {
+  if (_optionalChain([req, 'optionalAccess', _296 => _296.Userinfo, 'optionalAccess', _297 => _297[2]]) && !plainJson && !isRawUploadPost(_optionalChain([req, 'optionalAccess', _298 => _298.url])) && !isPlainSourcePost(_optionalChain([req, 'optionalAccess', _299 => _299.url]))) {
     pm = req.Userinfo[2];
     out = $asai.$lib.AsCode.asdecode(out, pm);
   }
@@ -2591,7 +2664,7 @@ function processPostPayload($asai, req, postdata, pm) {
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, processPostPayload, "processPostPayload");
 var Api_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai, opt = {}) => {
-  _optionalChain([opt, 'optionalAccess', _284 => _284.fn, 'optionalCall', _285 => _285($asai)]);
+  _optionalChain([opt, 'optionalAccess', _300 => _300.fn, 'optionalCall', _301 => _301($asai)]);
   function getHeader(req, key) {
     return req.headers[key.toLowerCase()] || "";
   }
@@ -2600,7 +2673,7 @@ var Api_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
   let apiRouteCacheLen = -1;
   function findApiHandler($asai2, pathname) {
     const apis = $asai2.hostserverapis;
-    if (!_optionalChain([apis, 'optionalAccess', _286 => _286.length])) return void 0;
+    if (!_optionalChain([apis, 'optionalAccess', _302 => _302.length])) return void 0;
     if (!apiRouteCache || apiRouteCacheLen !== apis.length) {
       apiRouteCache = apis.map((elp) => ({ key: elp, path: `/api/${elp}` }));
       apiRouteCacheLen = apis.length;
@@ -2648,9 +2721,9 @@ var Api_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
           pm: decodeURIComponent(urlParse.search.substring(4))
         };
         if (req.url.indexOf("binary") === -1) {
-          if (_optionalChain([req, 'optionalAccess', _287 => _287.Userinfo]) && _optionalChain([req, 'optionalAccess', _288 => _288.Userinfo, 'access', _289 => _289[2]]) && _optionalChain([query, 'optionalAccess', _290 => _290.pm])) {
+          if (_optionalChain([req, 'optionalAccess', _303 => _303.Userinfo]) && _optionalChain([req, 'optionalAccess', _304 => _304.Userinfo, 'access', _305 => _305[2]]) && _optionalChain([query, 'optionalAccess', _306 => _306.pm])) {
             pm = req.Userinfo[2];
-            query = $asai.$lib.AsCode.asdecode(_optionalChain([query, 'optionalAccess', _291 => _291.pm]), pm);
+            query = $asai.$lib.AsCode.asdecode(_optionalChain([query, 'optionalAccess', _307 => _307.pm]), pm);
             query = Object.fromEntries(new URLSearchParams("?" + query).entries());
           }
         }
@@ -2669,7 +2742,7 @@ var Api_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
       const releaseSlot = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, () => releaseApiSlot(hostdir, clientIp), "releaseSlot");
       res.once("finish", releaseSlot);
       res.once("close", releaseSlot);
-      const maxBody = _optionalChain([$asai, 'access', _292 => _292.hostconfig, 'optionalAccess', _293 => _293.maxbody]) || 100 * 1024 * 1024;
+      const maxBody = _optionalChain([$asai, 'access', _308 => _308.hostconfig, 'optionalAccess', _309 => _309.maxbody]) || 100 * 1024 * 1024;
       const isTextPost = req.method === "POST" && req.url.indexOf("binary") === -1;
       const bodyPromise = isTextPost ? readRequestBody(req, maxBody) : null;
       void (async () => {
@@ -2683,16 +2756,16 @@ var Api_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
             ]);
           } catch (err) {
             releaseSlot();
-            if (_optionalChain([err, 'optionalAccess', _294 => _294.message]) === "PAYLOAD_TOO_LARGE") {
+            if (_optionalChain([err, 'optionalAccess', _310 => _310.message]) === "PAYLOAD_TOO_LARGE") {
               return sendError(res, 413, "Payload Too Large");
             }
-            return sendError(res, 400, _optionalChain([err, 'optionalAccess', _295 => _295.message]) || "Bad Request");
+            return sendError(res, 400, _optionalChain([err, 'optionalAccess', _311 => _311.message]) || "Bad Request");
           }
           if (!authResult.ok) {
             releaseSlot();
             return sendAuthError(res, authResult);
           }
-          let apiFn = _optionalChain([$asai, 'access', _296 => _296.hostserverapi, 'access', _297 => _297[apiHandlerKey], 'optionalCall', _298 => _298($asai, query)]);
+          let apiFn = _optionalChain([$asai, 'access', _312 => _312.hostserverapi, 'access', _313 => _313[apiHandlerKey], 'optionalCall', _314 => _314($asai, query)]);
           if (!apiFn) {
             return sendError(res, 501, "Not Implemented");
           }
@@ -2708,23 +2781,23 @@ var Api_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
                 postdata = processed.postdata;
                 pm = processed.pm;
                 isAes = processed.isAes;
-              } catch (e35) {
+              } catch (e39) {
                 return sendError(res, 400, "AES decrypt failed");
               }
-              if (_optionalChain([apiFn, 'optionalAccess', _299 => _299.post]) && typeof _optionalChain([apiFn, 'optionalAccess', _300 => _300.post]) === "function") {
+              if (_optionalChain([apiFn, 'optionalAccess', _315 => _315.post]) && typeof _optionalChain([apiFn, 'optionalAccess', _316 => _316.post]) === "function") {
                 const optTmp = { qrdata, data: postdata, pm };
-                if (isAes || _optionalChain([$asai, 'access', _301 => _301.$lib, 'access', _302 => _302.aesfns, 'optionalAccess', _303 => _303.allaes])) {
-                  optTmp.resAES = _optionalChain([$asai, 'access', _304 => _304.$lib, 'access', _305 => _305.aesfns, 'optionalAccess', _306 => _306.resAES]);
+                if (isAes || _optionalChain([$asai, 'access', _317 => _317.$lib, 'access', _318 => _318.aesfns, 'optionalAccess', _319 => _319.allaes])) {
+                  optTmp.resAES = _optionalChain([$asai, 'access', _320 => _320.$lib, 'access', _321 => _321.aesfns, 'optionalAccess', _322 => _322.resAES]);
                 }
                 apiFn.post(req, res, hostdir, optTmp);
               } else {
                 res.end(typeof postdata === "string" ? postdata : JSON.stringify(_nullishCoalesce(postdata, () => ( ""))));
               }
             } else if (req.method === "GET") {
-              if (_optionalChain([apiFn, 'optionalAccess', _307 => _307.get]) && typeof _optionalChain([apiFn, 'optionalAccess', _308 => _308.get]) === "function") {
+              if (_optionalChain([apiFn, 'optionalAccess', _323 => _323.get]) && typeof _optionalChain([apiFn, 'optionalAccess', _324 => _324.get]) === "function") {
                 const optTmp = { qrdata, data: qrdata, pm };
-                if (isAes || _optionalChain([$asai, 'access', _309 => _309.$lib, 'access', _310 => _310.aesfns, 'optionalAccess', _311 => _311.allaes])) {
-                  optTmp.resAES = _optionalChain([$asai, 'access', _312 => _312.$lib, 'access', _313 => _313.aesfns, 'optionalAccess', _314 => _314.resAES]);
+                if (isAes || _optionalChain([$asai, 'access', _325 => _325.$lib, 'access', _326 => _326.aesfns, 'optionalAccess', _327 => _327.allaes])) {
+                  optTmp.resAES = _optionalChain([$asai, 'access', _328 => _328.$lib, 'access', _329 => _329.aesfns, 'optionalAccess', _330 => _330.resAES]);
                 }
                 apiFn.get(req, res, hostdir, optTmp);
               } else {
@@ -2732,12 +2805,12 @@ var Api_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
               }
             }
           } else {
-            if (_optionalChain([Object, 'access', _315 => _315.keys, 'call', _316 => _316(query), 'optionalAccess', _317 => _317.length])) {
+            if (_optionalChain([Object, 'access', _331 => _331.keys, 'call', _332 => _332(query), 'optionalAccess', _333 => _333.length])) {
               qrdata = query;
             }
             if (req.method === "POST") {
               $asai.$lib.AsNodeTool.upBinary(req).then((postdata2) => {
-                if (_optionalChain([apiFn, 'optionalAccess', _318 => _318.post]) && typeof _optionalChain([apiFn, 'optionalAccess', _319 => _319.post]) === "function") {
+                if (_optionalChain([apiFn, 'optionalAccess', _334 => _334.post]) && typeof _optionalChain([apiFn, 'optionalAccess', _335 => _335.post]) === "function") {
                   apiFn.post(req, res, hostdir, {
                     qrdata,
                     data: postdata2
@@ -2753,13 +2826,13 @@ var Api_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
         } catch (err) {
           releaseSlot();
           if (!res.headersSent) {
-            return sendError(res, 500, _optionalChain([err, 'optionalAccess', _320 => _320.message]) || "Internal Server Error");
+            return sendError(res, 500, _optionalChain([err, 'optionalAccess', _336 => _336.message]) || "Internal Server Error");
           }
         }
       })().catch((err) => {
         releaseSlot();
         if (!res.headersSent) {
-          sendError(res, 500, _optionalChain([err, 'optionalAccess', _321 => _321.message]) || "Internal Server Error");
+          sendError(res, 500, _optionalChain([err, 'optionalAccess', _337 => _337.message]) || "Internal Server Error");
         }
       });
     } else {
@@ -2772,12 +2845,12 @@ var Api_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
 
 // src/common/server/Ws.ts
 var Ws_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai, opt = {}) => {
-  _optionalChain([opt, 'optionalAccess', _322 => _322.fn, 'optionalCall', _323 => _323($asai)]);
+  _optionalChain([opt, 'optionalAccess', _338 => _338.fn, 'optionalCall', _339 => _339($asai)]);
   const wsHandlerCache = /* @__PURE__ */ new Map();
   const routeIndex = ensureWsRouteIndex($asai);
   function getWsHandler(handlerKey) {
     if (!wsHandlerCache.has(handlerKey)) {
-      wsHandlerCache.set(handlerKey, _optionalChain([$asai, 'access', _324 => _324.hostserverws, 'access', _325 => _325[handlerKey], 'optionalCall', _326 => _326($asai)]));
+      wsHandlerCache.set(handlerKey, _optionalChain([$asai, 'access', _340 => _340.hostserverws, 'access', _341 => _341[handlerKey], 'optionalCall', _342 => _342($asai)]));
     }
     return wsHandlerCache.get(handlerKey);
   }
@@ -2801,21 +2874,21 @@ var Ws_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai, o
       let reqdata = parseMessage(msg);
       let handlerKey;
       if (reqdata === "ping") {
-        _optionalChain([ws2, 'access', _327 => _327.send, 'optionalCall', _328 => _328("pong")]);
+        _optionalChain([ws2, 'access', _343 => _343.send, 'optionalCall', _344 => _344("pong")]);
         return;
       } else {
         const reqdataisobj = typeof reqdata === "object" && reqdata !== null;
-        handlerKey = reqdataisobj ? routeIndex.matchTy(_optionalChain([reqdata, 'optionalAccess', _329 => _329.ty])) : routeIndex.matchString(reqdata);
-        if (!handlerKey && _optionalChain([$asai, 'access', _330 => _330.hostserverwss, 'optionalAccess', _331 => _331.length])) {
+        handlerKey = reqdataisobj ? routeIndex.matchTy(_optionalChain([reqdata, 'optionalAccess', _345 => _345.ty])) : routeIndex.matchString(reqdata);
+        if (!handlerKey && _optionalChain([$asai, 'access', _346 => _346.hostserverwss, 'optionalAccess', _347 => _347.length])) {
           handlerKey = $asai.hostserverwss.find((elp) => {
             if (reqdataisobj) {
-              return _optionalChain([reqdata, 'optionalAccess', _332 => _332.ty, 'optionalAccess', _333 => _333.startsWith, 'call', _334 => _334(elp)]);
+              return _optionalChain([reqdata, 'optionalAccess', _348 => _348.ty, 'optionalAccess', _349 => _349.startsWith, 'call', _350 => _350(elp)]);
             }
             return typeof reqdata === "string" && reqdata.startsWith(elp);
           });
         }
         if (!handlerKey) {
-          _optionalChain([$asai, 'access', _335 => _335.asaimock, 'optionalAccess', _336 => _336.wsWorkMock, 'call', _337 => _337({
+          _optionalChain([$asai, 'access', _351 => _351.asaimock, 'optionalAccess', _352 => _352.wsWorkMock, 'call', _353 => _353({
             msg,
             ws: ws2,
             hostdir,
@@ -2827,14 +2900,14 @@ var Ws_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai, o
         }
       }
       if (!handlerKey) return;
-      _optionalChain([getWsHandler, 'call', _338 => _338(handlerKey), 'optionalAccess', _339 => _339.work, 'optionalCall', _340 => _340(reqdata, ws2, hostdir, req)]);
+      _optionalChain([getWsHandler, 'call', _354 => _354(handlerKey), 'optionalAccess', _355 => _355.work, 'optionalCall', _356 => _356(reqdata, ws2, hostdir, req)]);
     } catch (err) {
-      _optionalChain([($asai.$log || console.error), 'optionalCall', _341 => _341("WS", "handler error", err instanceof Error ? err.message : err)]);
+      _optionalChain([($asai.$log || console.error), 'optionalCall', _357 => _357("WS", "handler error", err instanceof Error ? err.message : err)]);
     }
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, wsWork, "wsWork");
   function _getMessage(msg) {
-    if (_optionalChain([msg, 'optionalAccess', _342 => _342.db, 'optionalAccess', _343 => _343.aes]) && _optionalChain([$asai, 'access', _344 => _344.$lib, 'optionalAccess', _345 => _345.aesfns, 'optionalAccess', _346 => _346.reqAES])) {
+    if (_optionalChain([msg, 'optionalAccess', _358 => _358.db, 'optionalAccess', _359 => _359.aes]) && _optionalChain([$asai, 'access', _360 => _360.$lib, 'optionalAccess', _361 => _361.aesfns, 'optionalAccess', _362 => _362.reqAES])) {
       msg.db = $asai.$lib.aesfns.reqAES({ data: msg.db });
     }
     return msg;
@@ -2861,12 +2934,12 @@ var Ws_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai, o
 
 // src/common/server/Sys.ts
 var Sys_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai, opt = {}) => {
-  _optionalChain([opt, 'optionalAccess', _347 => _347.fn, 'optionalCall', _348 => _348($asai)]);
+  _optionalChain([opt, 'optionalAccess', _363 => _363.fn, 'optionalCall', _364 => _364($asai)]);
   let sysRouteCache = null;
   let sysRouteCacheLen = -1;
   function findSystemHandler(req) {
     const routes = $asai.hostserversyss;
-    if (!_optionalChain([routes, 'optionalAccess', _349 => _349.length])) return void 0;
+    if (!_optionalChain([routes, 'optionalAccess', _365 => _365.length])) return void 0;
     if (!sysRouteCache || sysRouteCacheLen !== routes.length) {
       sysRouteCache = routes.map((elp) => ({ key: elp, route: `/${elp}` }));
       sysRouteCacheLen = routes.length;
@@ -2900,21 +2973,21 @@ var Sys_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
         if (!authResult.ok) {
           return sendAuthError(res, authResult);
         }
-        const handler = _optionalChain([$asai, 'access', _350 => _350.hostserversys, 'access', _351 => _351[handlerKey], 'optionalCall', _352 => _352($asai)]);
+        const handler = _optionalChain([$asai, 'access', _366 => _366.hostserversys, 'access', _367 => _367[handlerKey], 'optionalCall', _368 => _368($asai)]);
         if (!handler) {
           return sendError(res, 500, "Handler Initialization Failed");
         }
-        if (_optionalChain([handler, 'optionalAccess', _353 => _353.show]) && typeof _optionalChain([handler, 'optionalAccess', _354 => _354.show]) === "function") {
+        if (_optionalChain([handler, 'optionalAccess', _369 => _369.show]) && typeof _optionalChain([handler, 'optionalAccess', _370 => _370.show]) === "function") {
           handler.show(req, res, hostdir);
         } else {
           res.end("postdata");
         }
       } catch (err) {
-        return sendError(res, 500, _optionalChain([err, 'optionalAccess', _355 => _355.message]) || "Internal Server Error");
+        return sendError(res, 500, _optionalChain([err, 'optionalAccess', _371 => _371.message]) || "Internal Server Error");
       }
     })().catch((err) => {
       if (!res.headersSent) {
-        sendError(res, 500, _optionalChain([err, 'optionalAccess', _356 => _356.message]) || "Internal Server Error");
+        sendError(res, 500, _optionalChain([err, 'optionalAccess', _372 => _372.message]) || "Internal Server Error");
       }
     });
   }
@@ -2924,14 +2997,14 @@ var Sys_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
 
 // src/common/server/WsClient.ts
 var WsClient_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai, wsname) => {
-  if (!_optionalChain([$asai, 'optionalAccess', _357 => _357.clientws])) {
+  if (!_optionalChain([$asai, 'optionalAccess', _373 => _373.clientws])) {
     $asai.clientws = {};
   }
   if (!$asai.clientws[wsname]) {
     $asai.clientws[wsname] = { tasks: /* @__PURE__ */ new Map() };
   }
   function getKeyByData(msgdata) {
-    return _optionalChain([msgdata, 'optionalAccess', _358 => _358.id]) || _optionalChain([msgdata, 'optionalAccess', _359 => _359.ty]);
+    return _optionalChain([msgdata, 'optionalAccess', _374 => _374.id]) || _optionalChain([msgdata, 'optionalAccess', _375 => _375.ty]);
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, getKeyByData, "getKeyByData");
   function clientwsInit() {
@@ -2944,7 +3017,7 @@ var WsClient_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($a
       };
       $asai.clientws[wsname].socket.on("error", (err) => {
         $asai.clientws[wsname].open = 0;
-        _optionalChain([$asai, 'access', _360 => _360.hostconfig, 'access', _361 => _361.logger, 'optionalAccess', _362 => _362.lv, 'optionalAccess', _363 => _363.view]) && console.error(
+        _optionalChain([$asai, 'access', _376 => _376.hostconfig, 'access', _377 => _377.logger, 'optionalAccess', _378 => _378.lv, 'optionalAccess', _379 => _379.view]) && console.error(
           666.2203,
           `${wsname}=${$asai.command.commandconfig.clientws[wsname]} is error.`,
           err
@@ -2953,14 +3026,14 @@ var WsClient_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($a
       });
       $asai.clientws[wsname].socket.on("close", () => {
         $asai.clientws[wsname].open = 0;
-        _optionalChain([$asai, 'access', _364 => _364.hostconfig, 'access', _365 => _365.logger, 'optionalAccess', _366 => _366.lv, 'optionalAccess', _367 => _367.view]) && console.error(
+        _optionalChain([$asai, 'access', _380 => _380.hostconfig, 'access', _381 => _381.logger, 'optionalAccess', _382 => _382.lv, 'optionalAccess', _383 => _383.view]) && console.error(
           666.2205,
           `${wsname}=${$asai.command.commandconfig.clientws[wsname]} is close.`
         );
         reject();
       });
       $asai.clientws[wsname].socket.onopen = () => {
-        _optionalChain([$asai, 'access', _368 => _368.hostconfig, 'access', _369 => _369.logger, 'optionalAccess', _370 => _370.lv, 'optionalAccess', _371 => _371.view]) && console.log(
+        _optionalChain([$asai, 'access', _384 => _384.hostconfig, 'access', _385 => _385.logger, 'optionalAccess', _386 => _386.lv, 'optionalAccess', _387 => _387.view]) && console.log(
           666.2201,
           `${wsname}=${$asai.command.commandconfig.clientws[wsname]} is open.`
         );
@@ -2983,7 +3056,7 @@ var WsClient_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($a
         const key = getKeyByData(messageData);
         const task = $asai.clientws[wsname].tasks.get(key);
         if (task) {
-          _optionalChain([task, 'optionalAccess', _372 => _372.callback, 'call', _373 => _373(messageData)]);
+          _optionalChain([task, 'optionalAccess', _388 => _388.callback, 'call', _389 => _389(messageData)]);
           if (messageData.ty && !messageData.id) {
           } else {
             $asai.clientws[wsname].tasks.delete(key);
@@ -3037,7 +3110,7 @@ var WsClient_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($a
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, clientwsWatch, "clientwsWatch");
   function clientwsWatchOff(messageData) {
-    if (_optionalChain([messageData, 'optionalAccess', _374 => _374.ty]) === "clear") {
+    if (_optionalChain([messageData, 'optionalAccess', _390 => _390.ty]) === "clear") {
       $asai.clientws[wsname].tasks = /* @__PURE__ */ new Map();
     } else {
       const key = getKeyByData(messageData);
@@ -3078,7 +3151,7 @@ var ping_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai)
 var web_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai) => {
   function chatBoard(msgdata, ws2, hostdir, req) {
     let room;
-    if (_optionalChain([msgdata, 'access', _375 => _375.db, 'optionalAccess', _376 => _376.room]) && typeof msgdata.db.room === "string") {
+    if (_optionalChain([msgdata, 'access', _391 => _391.db, 'optionalAccess', _392 => _392.room]) && typeof msgdata.db.room === "string") {
       room = msgdata.db.room;
       delete msgdata.db.room;
     } else {
@@ -3135,26 +3208,26 @@ var logmanage_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($
     removeFile: removeFile2,
     resolvePathUnderBase: resolvePathUnderBase2
   } = $asai.$lib.AsFs;
-  const { sendSuccess, sendFail, mnLog } = _optionalChain([$asai, 'access', _377 => _377.$lib, 'optionalAccess', _378 => _378.reqWork, 'optionalCall', _379 => _379($asai)]);
+  const { sendSuccess, sendFail, mnLog } = _optionalChain([$asai, 'access', _393 => _393.$lib, 'optionalAccess', _394 => _394.reqWork, 'optionalCall', _395 => _395($asai)]);
   function mgLog(...arg) {
     mnLog("LOG", ...arg);
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, mgLog, "mgLog");
   function getDir(opt) {
-    let tmpDir = _optionalChain([opt, 'access', _380 => _380.qrdata, 'optionalAccess', _381 => _381.dir]) || _optionalChain([opt, 'access', _382 => _382.data, 'optionalAccess', _383 => _383.dir]);
+    let tmpDir = _optionalChain([opt, 'access', _396 => _396.qrdata, 'optionalAccess', _397 => _397.dir]) || _optionalChain([opt, 'access', _398 => _398.data, 'optionalAccess', _399 => _399.dir]);
     if (tmpDir) {
       tmpDir = decodeURIComponent(tmpDir);
     } else {
-      tmpDir = _optionalChain([opt, 'access', _384 => _384.qrdata, 'optionalAccess', _385 => _385.ty]) || _optionalChain([opt, 'access', _386 => _386.data, 'optionalAccess', _387 => _387.ty]);
+      tmpDir = _optionalChain([opt, 'access', _400 => _400.qrdata, 'optionalAccess', _401 => _401.ty]) || _optionalChain([opt, 'access', _402 => _402.data, 'optionalAccess', _403 => _403.ty]);
       if (tmpDir) {
         tmpDir = decodeURIComponent(tmpDir);
         if (tmpDir === "access-clf" || tmpDir === "access-w3c") {
-          tmpDir = _optionalChain([$asai, 'access', _388 => _388.hostconfig, 'access', _389 => _389.logger, 'optionalAccess', _390 => _390.path, 'optionalAccess', _391 => _391.access]) || "";
+          tmpDir = _optionalChain([$asai, 'access', _404 => _404.hostconfig, 'access', _405 => _405.logger, 'optionalAccess', _406 => _406.path, 'optionalAccess', _407 => _407.access]) || "";
         } else {
-          tmpDir = _optionalChain([$asai, 'access', _392 => _392.hostconfig, 'access', _393 => _393.logger, 'optionalAccess', _394 => _394.path, 'optionalAccess', _395 => _395[tmpDir]]) || "";
+          tmpDir = _optionalChain([$asai, 'access', _408 => _408.hostconfig, 'access', _409 => _409.logger, 'optionalAccess', _410 => _410.path, 'optionalAccess', _411 => _411[tmpDir]]) || "";
         }
       } else {
-        tmpDir = _optionalChain([$asai, 'access', _396 => _396.hostconfig, 'access', _397 => _397.logger, 'optionalAccess', _398 => _398.path, 'optionalAccess', _399 => _399.client]) || "";
+        tmpDir = _optionalChain([$asai, 'access', _412 => _412.hostconfig, 'access', _413 => _413.logger, 'optionalAccess', _414 => _414.path, 'optionalAccess', _415 => _415.client]) || "";
       }
     }
     return tmpDir;
@@ -3186,7 +3259,7 @@ var logmanage_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($
       if (!await ensureLv(req, $asai, 3)) return sendFail(res, "Forbidden", opt);
       try {
         const baseDir = getDir(opt);
-        const relPath = decodeURIComponent(_optionalChain([opt, 'access', _400 => _400.qrdata, 'optionalAccess', _401 => _401.path]) || _optionalChain([opt, 'access', _402 => _402.data, 'optionalAccess', _403 => _403.path]));
+        const relPath = decodeURIComponent(_optionalChain([opt, 'access', _416 => _416.qrdata, 'optionalAccess', _417 => _417.path]) || _optionalChain([opt, 'access', _418 => _418.data, 'optionalAccess', _419 => _419.path]));
         const jsonpath = resolvePathUnderBase2(baseDir, relPath);
         await ensureFile2(jsonpath);
         mgLog("ENSURE", jsonpath);
@@ -3207,7 +3280,7 @@ var logmanage_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($
     if (url.startsWith("/api/asailog/manage/selectlist/")) {
       if (!await ensureLv(req, $asai, _chunkGXOFLFFWcjs.getPermissionThreshold.call(void 0, $asai, "logRead"))) return sendFail(res, "Forbidden", opt);
       try {
-        const ty = decodeURIComponent(_optionalChain([opt, 'access', _404 => _404.qrdata, 'optionalAccess', _405 => _405.ty]) || _optionalChain([opt, 'access', _406 => _406.data, 'optionalAccess', _407 => _407.ty]) || "client");
+        const ty = decodeURIComponent(_optionalChain([opt, 'access', _420 => _420.qrdata, 'optionalAccess', _421 => _421.ty]) || _optionalChain([opt, 'access', _422 => _422.data, 'optionalAccess', _423 => _423.ty]) || "client");
         if (!_chunkHR5JKN7Ycjs.prefersDiskLogAccess.call(void 0, $asai) && _chunkHR5JKN7Ycjs.isLogStoreEnabled.call(void 0, $asai) && (ty === "client" || ty === "server" || ty === "sec")) {
           const kind = ty === "sec" ? "sec" : "web";
           const groups = await _chunkHR5JKN7Ycjs.listUnifiedGroups.call(void 0, $asai, { kind, source: ty === "sec" ? "sec" : ty });
@@ -3235,8 +3308,8 @@ var logmanage_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($
     if (url.startsWith("/api/asailog/manage/select/")) {
       if (!await ensureLv(req, $asai, _chunkGXOFLFFWcjs.getPermissionThreshold.call(void 0, $asai, "logRead"))) return sendFail(res, "Forbidden", opt);
       try {
-        const ty = decodeURIComponent(_optionalChain([opt, 'access', _408 => _408.qrdata, 'optionalAccess', _409 => _409.ty]) || _optionalChain([opt, 'access', _410 => _410.data, 'optionalAccess', _411 => _411.ty]) || "client");
-        const relPath = decodeURIComponent(_optionalChain([opt, 'access', _412 => _412.qrdata, 'optionalAccess', _413 => _413.path]) || _optionalChain([opt, 'access', _414 => _414.data, 'optionalAccess', _415 => _415.path]));
+        const ty = decodeURIComponent(_optionalChain([opt, 'access', _424 => _424.qrdata, 'optionalAccess', _425 => _425.ty]) || _optionalChain([opt, 'access', _426 => _426.data, 'optionalAccess', _427 => _427.ty]) || "client");
+        const relPath = decodeURIComponent(_optionalChain([opt, 'access', _428 => _428.qrdata, 'optionalAccess', _429 => _429.path]) || _optionalChain([opt, 'access', _430 => _430.data, 'optionalAccess', _431 => _431.path]));
         if (!_chunkHR5JKN7Ycjs.prefersDiskLogAccess.call(void 0, $asai) && _chunkHR5JKN7Ycjs.isLogStoreEnabled.call(void 0, $asai) && (ty === "client" || ty === "server" || ty === "sec")) {
           const data2 = await _chunkHR5JKN7Ycjs.readWebLogFromStore.call(void 0, $asai, ty, relPath);
           if (data2) {
@@ -3264,7 +3337,7 @@ var logmanage_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($
       if (!await ensureLv(req, $asai, 3)) return sendFail(res, "Forbidden", opt);
       try {
         const baseDir = getDir(opt);
-        const relPath = decodeURIComponent(_optionalChain([opt, 'access', _416 => _416.qrdata, 'optionalAccess', _417 => _417.path]) || _optionalChain([opt, 'access', _418 => _418.data, 'optionalAccess', _419 => _419.path]));
+        const relPath = decodeURIComponent(_optionalChain([opt, 'access', _432 => _432.qrdata, 'optionalAccess', _433 => _433.path]) || _optionalChain([opt, 'access', _434 => _434.data, 'optionalAccess', _435 => _435.path]));
         const fileName = relPath.split(/[/\\]/).pop() || relPath;
         if (_chunkHR5JKN7Ycjs.isLogStoreEnabled.call(void 0, $asai)) {
           await _chunkHR5JKN7Ycjs.purgeStoreEntriesForFile.call(void 0, $asai, fileName).catch(() => void 0);
@@ -3287,14 +3360,14 @@ var logmanage_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($
 
 // src/infra/siem-auth.ts
 function isSiemEnabled($asai) {
-  const cfg = _optionalChain([$asai, 'optionalAccess', _420 => _420.hostconfig, 'optionalAccess', _421 => _421.logger, 'optionalAccess', _422 => _422.siem]);
-  return !!(_optionalChain([cfg, 'optionalAccess', _423 => _423.enabled]) && getSiemToken($asai));
+  const cfg = _optionalChain([$asai, 'optionalAccess', _436 => _436.hostconfig, 'optionalAccess', _437 => _437.logger, 'optionalAccess', _438 => _438.siem]);
+  return !!(_optionalChain([cfg, 'optionalAccess', _439 => _439.enabled]) && getSiemToken($asai));
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, isSiemEnabled, "isSiemEnabled");
 function getSiemToken($asai) {
   const fromEnv = process.env.ASAI_SIEM_TOKEN;
   if (typeof fromEnv === "string" && fromEnv.trim()) return fromEnv.trim();
-  const fromCfg = _optionalChain([$asai, 'optionalAccess', _424 => _424.hostconfig, 'optionalAccess', _425 => _425.logger, 'optionalAccess', _426 => _426.siem, 'optionalAccess', _427 => _427.token]);
+  const fromCfg = _optionalChain([$asai, 'optionalAccess', _440 => _440.hostconfig, 'optionalAccess', _441 => _441.logger, 'optionalAccess', _442 => _442.siem, 'optionalAccess', _443 => _443.token]);
   return typeof fromCfg === "string" ? fromCfg.trim() : "";
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, getSiemToken, "getSiemToken");
@@ -3302,9 +3375,9 @@ function isSiemTokenValid($asai, req) {
   if (!isSiemEnabled($asai)) return false;
   const expected = getSiemToken($asai);
   if (!expected) return false;
-  const header = _optionalChain([req, 'optionalAccess', _428 => _428.headers, 'optionalAccess', _429 => _429["x-siem-token"]]) || _optionalChain([req, 'optionalAccess', _430 => _430.headers, 'optionalAccess', _431 => _431["x-api-key"]]);
+  const header = _optionalChain([req, 'optionalAccess', _444 => _444.headers, 'optionalAccess', _445 => _445["x-siem-token"]]) || _optionalChain([req, 'optionalAccess', _446 => _446.headers, 'optionalAccess', _447 => _447["x-api-key"]]);
   if (typeof header === "string" && header === expected) return true;
-  const q = _optionalChain([req, 'optionalAccess', _432 => _432.query]) || {};
+  const q = _optionalChain([req, 'optionalAccess', _448 => _448.query]) || {};
   const qToken = q.siem_token || q.token;
   return typeof qToken === "string" && qToken === expected;
 }
@@ -3328,20 +3401,20 @@ function getNs(raw) {
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, getNs, "getNs");
 async function ensureServerUser(req, $asai) {
-  if (Array.isArray(_optionalChain([req, 'optionalAccess', _433 => _433.Userinfo])) && req.Userinfo[0]) {
+  if (Array.isArray(_optionalChain([req, 'optionalAccess', _449 => _449.Userinfo])) && req.Userinfo[0]) {
     await attachServerUserLevel(req, $asai);
   }
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, ensureServerUser, "ensureServerUser");
 var interventionlog_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai) => {
-  const { sendSuccess, sendFail } = _optionalChain([$asai, 'access', _434 => _434.$lib, 'optionalAccess', _435 => _435.reqWork, 'optionalCall', _436 => _436($asai)]) || {};
+  const { sendSuccess, sendFail } = _optionalChain([$asai, 'access', _450 => _450.$lib, 'optionalAccess', _451 => _451.reqWork, 'optionalCall', _452 => _452($asai)]) || {};
   const IL = $asai.$lib.InterventionLog;
   async function get(req, res, hostdir, opt) {
     const url = req.url || "";
     if (url.startsWith("/api/asailog/intervention/selectlist/")) {
       if (!await ensureLogReadAccess(req, $asai, _chunkGXOFLFFWcjs.getPermissionThreshold.call(void 0, $asai, "logRead"))) return sendFail(res, "Forbidden", opt);
       try {
-        const ns = getNs(_optionalChain([opt, 'access', _437 => _437.qrdata, 'optionalAccess', _438 => _438.ns]) || _optionalChain([opt, 'access', _439 => _439.data, 'optionalAccess', _440 => _440.ns]));
+        const ns = getNs(_optionalChain([opt, 'access', _453 => _453.qrdata, 'optionalAccess', _454 => _454.ns]) || _optionalChain([opt, 'access', _455 => _455.data, 'optionalAccess', _456 => _456.ns]));
         let list = await IL.listInterventionFiles($asai, ns);
         if (_chunkHR5JKN7Ycjs.isLogStoreEnabled.call(void 0, $asai) && !_chunkHR5JKN7Ycjs.prefersDiskLogAccess.call(void 0, $asai)) {
           const groups = await _chunkHR5JKN7Ycjs.listUnifiedGroups.call(void 0, $asai, { kind: "intervention", ns });
@@ -3353,19 +3426,19 @@ var interventionlog_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void
         }
         return sendSuccess(res, { ns, files: list }, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _441 => _441.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _457 => _457.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/asailog/intervention/select/")) {
       if (!await ensureLogReadAccess(req, $asai, _chunkGXOFLFFWcjs.getPermissionThreshold.call(void 0, $asai, "logRead"))) return sendFail(res, "Forbidden", opt);
       try {
-        const name = decodeURIComponent(_optionalChain([opt, 'access', _442 => _442.qrdata, 'optionalAccess', _443 => _443.name]) || _optionalChain([opt, 'access', _444 => _444.data, 'optionalAccess', _445 => _445.name]) || "");
-        const ns = getNs(_optionalChain([opt, 'access', _446 => _446.qrdata, 'optionalAccess', _447 => _447.ns]) || _optionalChain([opt, 'access', _448 => _448.data, 'optionalAccess', _449 => _449.ns]));
+        const name = decodeURIComponent(_optionalChain([opt, 'access', _458 => _458.qrdata, 'optionalAccess', _459 => _459.name]) || _optionalChain([opt, 'access', _460 => _460.data, 'optionalAccess', _461 => _461.name]) || "");
+        const ns = getNs(_optionalChain([opt, 'access', _462 => _462.qrdata, 'optionalAccess', _463 => _463.ns]) || _optionalChain([opt, 'access', _464 => _464.data, 'optionalAccess', _465 => _465.ns]));
         if (!name) return sendFail(res, "name required", opt);
         const content = await IL.readInterventionFile($asai, name, ns);
         return sendSuccess(res, { ns, ...content }, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _450 => _450.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _466 => _466.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/asailog/intervention/types/")) {
@@ -3373,7 +3446,7 @@ var interventionlog_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void
       try {
         return sendSuccess(res, IL.getInterventionTaxonomy($asai), opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _451 => _451.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _467 => _467.message]) || err, opt);
       }
     }
   }
@@ -3403,7 +3476,7 @@ var interventionlog_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void
         );
         return sendSuccess(res, { ns, ...result }, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _452 => _452.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _468 => _468.message]) || err, opt);
       }
     }
   }
@@ -3422,11 +3495,11 @@ function parseQuery(opt) {
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, parseQuery, "parseQuery");
 function parseBody(opt) {
-  if (!_optionalChain([opt, 'optionalAccess', _453 => _453.data])) return {};
+  if (!_optionalChain([opt, 'optionalAccess', _469 => _469.data])) return {};
   if (typeof opt.data === "string") {
     try {
       return JSON.parse(opt.data);
-    } catch (e36) {
+    } catch (e40) {
       return {};
     }
   }
@@ -3434,7 +3507,7 @@ function parseBody(opt) {
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, parseBody, "parseBody");
 var unifiedlog_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai) => {
-  const { sendSuccess, sendFail } = _optionalChain([$asai, 'access', _454 => _454.$lib, 'optionalAccess', _455 => _455.reqWork, 'optionalCall', _456 => _456($asai)]) || {};
+  const { sendSuccess, sendFail } = _optionalChain([$asai, 'access', _470 => _470.$lib, 'optionalAccess', _471 => _471.reqWork, 'optionalCall', _472 => _472($asai)]) || {};
   const IL = $asai.$lib.InterventionLog;
   async function get(req, res, hostdir, opt) {
     const url = req.url || "";
@@ -3444,7 +3517,7 @@ var unifiedlog_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, (
       try {
         return sendSuccess(res, _chunkHR5JKN7Ycjs.getLogStoreMeta.call(void 0, $asai), opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _457 => _457.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _473 => _473.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/asailog/store/stats/")) {
@@ -3457,7 +3530,7 @@ var unifiedlog_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, (
         const stats = await _chunkHR5JKN7Ycjs.getUnifiedStats.call(void 0, $asai);
         return sendSuccess(res, { store: storeType, stats, config: _chunkHR5JKN7Ycjs.getLogStoreMeta.call(void 0, $asai) }, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _458 => _458.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _474 => _474.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/asailog/store/compliance/")) {
@@ -3467,7 +3540,7 @@ var unifiedlog_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, (
         const report = await _chunkHR5JKN7Ycjs.getComplianceReport.call(void 0, $asai, ns);
         return sendSuccess(res, report, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _459 => _459.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _475 => _475.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/asailog/store/search/")) {
@@ -3489,7 +3562,7 @@ var unifiedlog_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, (
         });
         return sendSuccess(res, result, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _460 => _460.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _476 => _476.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/asailog/store/export/")) {
@@ -3510,7 +3583,7 @@ var unifiedlog_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, (
         });
         return sendSuccess(res, payload, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _461 => _461.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _477 => _477.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/asailog/store/taxonomy/")) {
@@ -3518,7 +3591,7 @@ var unifiedlog_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, (
       try {
         return sendSuccess(res, IL.getInterventionTaxonomy($asai), opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _462 => _462.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _478 => _478.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/asailog/store/formats/")) {
@@ -3527,7 +3600,7 @@ var unifiedlog_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, (
         const { getLogFormatTaxonomy } = await Promise.resolve().then(() => _interopRequireWildcard(require("./log-formats-TUXGMCCU.cjs")));
         return sendSuccess(res, getLogFormatTaxonomy($asai), opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _463 => _463.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _479 => _479.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/asailog/store/selectlist/")) {
@@ -3554,7 +3627,7 @@ var unifiedlog_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, (
         }
         return sendSuccess(res, { groups }, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _464 => _464.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _480 => _480.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/asailog/store/select/")) {
@@ -3588,7 +3661,7 @@ var unifiedlog_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, (
         });
         return sendSuccess(res, { entries: rows }, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _465 => _465.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _481 => _481.message]) || err, opt);
       }
     }
   }
@@ -3610,7 +3683,7 @@ var unifiedlog_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, (
       });
       return sendSuccess(res, result, opt);
     } catch (err) {
-      return sendFail(res, _optionalChain([err, 'optionalAccess', _466 => _466.message]) || err, opt);
+      return sendFail(res, _optionalChain([err, 'optionalAccess', _482 => _482.message]) || err, opt);
     }
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, post, "post");
@@ -3622,7 +3695,7 @@ var unifiedlog_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, (
 
 var registry = null;
 function resolveFilePath($asai) {
-  const root = _optionalChain([$asai, 'optionalAccess', _467 => _467.serverRoot]) || process.cwd();
+  const root = _optionalChain([$asai, 'optionalAccess', _483 => _483.serverRoot]) || process.cwd();
   return nodePath3.join(root, "websys/sys/errorcodes.json");
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, resolveFilePath, "resolveFilePath");
@@ -3632,7 +3705,7 @@ function loadErrorCodes($asai) {
   try {
     const raw = fs8.readFileSync(filePath, "utf8");
     registry = JSON.parse(raw);
-  } catch (e37) {
+  } catch (e41) {
     registry = { version: "0", errors: {} };
   }
   if ($asai) $asai.errorcodes = registry;
@@ -3640,7 +3713,7 @@ function loadErrorCodes($asai) {
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, loadErrorCodes, "loadErrorCodes");
 function getError(ec) {
-  return _optionalChain([registry, 'optionalAccess', _468 => _468.errors, 'optionalAccess', _469 => _469[ec]]) || null;
+  return _optionalChain([registry, 'optionalAccess', _484 => _484.errors, 'optionalAccess', _485 => _485[ec]]) || null;
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, getError, "getError");
 function hasError(ec) {
@@ -3649,11 +3722,11 @@ function hasError(ec) {
 _chunkSMVZ3ZDJcjs.__name.call(void 0, hasError, "hasError");
 function logError($asai, ec, params) {
   const entry = getError(ec);
-  const logFn = _optionalChain([$asai, 'optionalAccess', _470 => _470.$log]) || console.warn;
+  const logFn = _optionalChain([$asai, 'optionalAccess', _486 => _486.$log]) || console.warn;
   if (entry) {
-    logFn(`[EC:${ec}]`, entry.id || "", entry.detail || "", _optionalChain([params, 'optionalAccess', _471 => _471.length]) ? params : "");
+    logFn(`[EC:${ec}]`, entry.id || "", entry.detail || "", _optionalChain([params, 'optionalAccess', _487 => _487.length]) ? params : "");
   } else {
-    logFn(`[EC:${ec}]`, "(unregistered)", _optionalChain([params, 'optionalAccess', _472 => _472.length]) ? params : "");
+    logFn(`[EC:${ec}]`, "(unregistered)", _optionalChain([params, 'optionalAccess', _488 => _488.length]) ? params : "");
   }
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, logError, "logError");
@@ -3681,14 +3754,14 @@ var ErrorCode_default = {
 
 // src/sysserver/api/common/errorcodes.ts
 var errorcodes_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai) => {
-  const { sendSuccess, sendFail } = _optionalChain([$asai, 'access', _473 => _473.$lib, 'optionalAccess', _474 => _474.reqWork, 'optionalCall', _475 => _475($asai)]) || {};
+  const { sendSuccess, sendFail } = _optionalChain([$asai, 'access', _489 => _489.$lib, 'optionalAccess', _490 => _490.reqWork, 'optionalCall', _491 => _491($asai)]) || {};
   function get(req, res, _hostdir, opt) {
     const url = req.url || "";
     if (url.startsWith("/api/sys/errorcodes/")) {
       try {
         return sendSuccess(res, loadErrorCodes($asai), opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _476 => _476.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _492 => _492.message]) || err, opt);
       }
     }
   }
@@ -3698,9 +3771,9 @@ var errorcodes_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, (
 
 // src/sysserver/api/common/sqlitemanage.ts
 var sqlitemanage_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai) => {
-  const { sendSuccess, sendFail, mnLog } = _optionalChain([$asai, 'optionalAccess', _477 => _477.$lib, 'optionalAccess', _478 => _478.reqWork, 'optionalCall', _479 => _479($asai)]) || {};
+  const { sendSuccess, sendFail, mnLog } = _optionalChain([$asai, 'optionalAccess', _493 => _493.$lib, 'optionalAccess', _494 => _494.reqWork, 'optionalCall', _495 => _495($asai)]) || {};
   function mgLog(...arg) {
-    _optionalChain([mnLog, 'optionalCall', _480 => _480("SQLite", ...arg)]);
+    _optionalChain([mnLog, 'optionalCall', _496 => _496("SQLite", ...arg)]);
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, mgLog, "mgLog");
   return $asai.$lib.AsDb($asai, {
@@ -3718,7 +3791,7 @@ var sqlitemanage_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0,
       if (req.url.startsWith("/api/asaisqlite/manage/post")) {
         try {
           mgLog("POST", "custom handler triggered");
-          _optionalChain([sendSuccess, 'optionalCall', _481 => _481(res, { data: "post" }, opt)]);
+          _optionalChain([sendSuccess, 'optionalCall', _497 => _497(res, { data: "post" }, opt)]);
         } catch (err) {
           mgLog("ERROR", "post handler", err);
         }
@@ -3735,10 +3808,10 @@ var sqlitemanage_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0,
             table: dataObj.table
           });
           mgLog("SELECT", "completed");
-          _optionalChain([sendSuccess, 'optionalCall', _482 => _482(res, resdb, opt)]);
+          _optionalChain([sendSuccess, 'optionalCall', _498 => _498(res, resdb, opt)]);
         } catch (errdb) {
           mgLog("ERROR", "select", errdb);
-          _optionalChain([sendFail, 'optionalCall', _483 => _483(res, errdb, opt)]);
+          _optionalChain([sendFail, 'optionalCall', _499 => _499(res, errdb, opt)]);
         }
         return "ok";
       }
@@ -3754,7 +3827,7 @@ function promLine(name, value, labels) {
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, promLine, "promLine");
 var health_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai) => {
-  const { sendSuccess, sendFail } = _optionalChain([$asai, 'access', _484 => _484.$lib, 'optionalAccess', _485 => _485.reqWork, 'optionalCall', _486 => _486($asai)]) || {};
+  const { sendSuccess, sendFail } = _optionalChain([$asai, 'access', _500 => _500.$lib, 'optionalAccess', _501 => _501.reqWork, 'optionalCall', _502 => _502($asai)]) || {};
   async function get(req, res, _hostdir, opt) {
     const url = req.url || "";
     if (url.startsWith("/api/sys/health/metrics/")) {
@@ -3763,10 +3836,10 @@ var health_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asa
         let httpTotal = 0;
         let wsTotal = 0;
         for (const set of Object.values($asai.connectionshttp || {})) {
-          httpTotal += _optionalChain([set, 'optionalAccess', _487 => _487.size]) || 0;
+          httpTotal += _optionalChain([set, 'optionalAccess', _503 => _503.size]) || 0;
         }
         for (const set of Object.values($asai.connectionsws || {})) {
-          wsTotal += _optionalChain([set, 'optionalAccess', _488 => _488.size]) || 0;
+          wsTotal += _optionalChain([set, 'optionalAccess', _504 => _504.size]) || 0;
         }
         const lines = [
           "# HELP asai_uptime_seconds Process uptime",
@@ -3788,7 +3861,7 @@ var health_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asa
         res.writeHead(200, { "Content-Type": "text/plain; charset=utf-8" });
         return res.end(lines.join("\n") + "\n");
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _489 => _489.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _505 => _505.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/sys/health/status/")) {
@@ -3801,10 +3874,10 @@ var health_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asa
           memory: process.memoryUsage(),
           quota: {
             http: Object.fromEntries(
-              Object.entries($asai.connectionshttp || {}).map(([k, v]) => [k, _optionalChain([v, 'optionalAccess', _490 => _490.size]) || 0])
+              Object.entries($asai.connectionshttp || {}).map(([k, v]) => [k, _optionalChain([v, 'optionalAccess', _506 => _506.size]) || 0])
             ),
             ws: Object.fromEntries(
-              Object.entries($asai.connectionsws || {}).map(([k, v]) => [k, _optionalChain([v, 'optionalAccess', _491 => _491.size]) || 0])
+              Object.entries($asai.connectionsws || {}).map(([k, v]) => [k, _optionalChain([v, 'optionalAccess', _507 => _507.size]) || 0])
             )
           }
         },
@@ -3845,7 +3918,7 @@ _chunkSMVZ3ZDJcjs.__name.call(void 0, sanitizeString, "sanitizeString");
 // src/sysserver/api/login/service/session.ts
 
 function getSessionTtlMs($asai) {
-  const hours = _nullishCoalesce(_optionalChain([$asai, 'optionalAccess', _492 => _492.hostconfig, 'optionalAccess', _493 => _493.security, 'optionalAccess', _494 => _494.sessionTtlHours]), () => ( 24));
+  const hours = _nullishCoalesce(_optionalChain([$asai, 'optionalAccess', _508 => _508.hostconfig, 'optionalAccess', _509 => _509.security, 'optionalAccess', _510 => _510.sessionTtlHours]), () => ( 24));
   return Number(hours) * 3600 * 1e3;
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, getSessionTtlMs, "getSessionTtlMs");
@@ -3862,7 +3935,7 @@ _chunkSMVZ3ZDJcjs.__name.call(void 0, generatePriKey, "generatePriKey");
 function createSessionKeys($asai) {
   const sessionId = _crypto.randomUUID.call(void 0, );
   const pri = generatePriKey();
-  const sn = _optionalChain([$asai, 'optionalAccess', _495 => _495.hostconfig, 'optionalAccess', _496 => _496.asaisn]);
+  const sn = _optionalChain([$asai, 'optionalAccess', _511 => _511.hostconfig, 'optionalAccess', _512 => _512.asaisn]);
   if (!sn) throw new Error("[session] ASAI_ASAISN \u672A\u914D\u7F6E");
   const pub = $asai.$lib.AsCode.asencode(pri, sn);
   return { pri, pub, sessionId };
@@ -3912,20 +3985,20 @@ function unwrapJsonString(value) {
   if (!text.startsWith("{") && !text.startsWith("[")) return value;
   try {
     return JSON.parse(text);
-  } catch (e38) {
+  } catch (e42) {
     return value;
   }
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, unwrapJsonString, "unwrapJsonString");
 function parseAuthBody(opt) {
-  let raw = _optionalChain([opt, 'optionalAccess', _497 => _497.data]);
+  let raw = _optionalChain([opt, 'optionalAccess', _513 => _513.data]);
   if (raw == null || raw === "") return {};
   if (typeof raw === "string") {
     const text = raw.trim();
     if (!text) return {};
     try {
       raw = JSON.parse(text);
-    } catch (e39) {
+    } catch (e43) {
       if (text.includes("=") && !text.startsWith("{") && !text.startsWith("[")) {
         raw = Object.fromEntries(new URLSearchParams(text));
       } else {
@@ -3994,7 +4067,7 @@ _chunkSMVZ3ZDJcjs.__name.call(void 0, purgeOfflineSessions, "purgeOfflineSession
 
 // src/sysserver/api/login/index.ts
 function getSecurity($asai) {
-  return _optionalChain([$asai, 'optionalAccess', _498 => _498.hostconfig, 'optionalAccess', _499 => _499.security]) || {};
+  return _optionalChain([$asai, 'optionalAccess', _514 => _514.hostconfig, 'optionalAccess', _515 => _515.security]) || {};
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, getSecurity, "getSecurity");
 function getQuota2($asai) {
@@ -4007,7 +4080,7 @@ async function canLogin($asai, us, hostdir) {
   if (!quota.enabled) return { ok: true };
   const store = _chunkZK4O4Z2Ocjs.createUserStore.call(void 0, $asai);
   const total = await countOnlineSessions($asai, hostdir, store);
-  const maxLogin = _nullishCoalesce(_nullishCoalesce(quota.maxLoginSessions, () => ( _optionalChain([$asai, 'optionalAccess', _500 => _500.hostconfig, 'optionalAccess', _501 => _501.hosts, 'optionalAccess', _502 => _502.default, 'optionalAccess', _503 => _503.maxonline]))), () => ( 100));
+  const maxLogin = _nullishCoalesce(_nullishCoalesce(quota.maxLoginSessions, () => ( _optionalChain([$asai, 'optionalAccess', _516 => _516.hostconfig, 'optionalAccess', _517 => _517.hosts, 'optionalAccess', _518 => _518.default, 'optionalAccess', _519 => _519.maxonline]))), () => ( 100));
   if (total >= maxLogin) {
     return { ok: false, message: "LOGIN_QUOTA_FULL" };
   }
@@ -4040,7 +4113,7 @@ function ensureReady($asai) {
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, ensureReady, "ensureReady");
 var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai) => {
-  const { sendSuccess, sendFail, sendErr } = _optionalChain([$asai, 'access', _504 => _504.$lib, 'optionalAccess', _505 => _505.reqWork, 'optionalCall', _506 => _506($asai)]) || {};
+  const { sendSuccess, sendFail, sendErr } = _optionalChain([$asai, 'access', _520 => _520.$lib, 'optionalAccess', _521 => _521.reqWork, 'optionalCall', _522 => _522($asai)]) || {};
   const store = _chunkZK4O4Z2Ocjs.createUserStore.call(void 0, $asai);
   async function checkAdmin(req, pathname, minOverride) {
     await attachServerUserLevel(req, $asai);
@@ -4081,7 +4154,7 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
         logSecurityEvent($asai, { type: "AUTH_SUCCESS", path: url, method: "POST", user: us, ip, detail: "password_changed" });
         return sendSuccess(res, { ok: true }, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _507 => _507.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _523 => _523.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/user/login/register/")) {
@@ -4114,11 +4187,11 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
         logSecurityEvent($asai, { type: "AUTH_SUCCESS", path: url, method: "POST", user: us, ip, detail: "register_ok" });
         return sendSuccess(res, { user: publicUser($asai, user) }, opt);
       } catch (err) {
-        const msg = _optionalChain([err, 'optionalAccess', _508 => _508.message]) || String(err);
+        const msg = _optionalChain([err, 'optionalAccess', _524 => _524.message]) || String(err);
         if (msg.includes("exists") || msg.includes("\u5DF2\u5B58\u5728")) {
           return sendErr(res, "USER_ALREADY_EXISTS", void 0, opt);
         }
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _509 => _509.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _525 => _525.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/user/login/auth/")) {
@@ -4152,9 +4225,15 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
         }
         const policy = _chunkGXOFLFFWcjs.getPasswordPolicy.call(void 0, $asai);
         const mustChange = !!user.mustChangePassword || _chunkGXOFLFFWcjs.isPasswordExpired.call(void 0, user.passwordChangedAt, policy.maxAgeDays);
-        const hostcfg = _optionalChain([$asai, 'access', _510 => _510.getHost, 'optionalCall', _511 => _511(hostdir)]) || {};
-        if (hostcfg.ckws && isUserOnlineOnWs($asai, us, hostdir)) {
-          kickUserWs($asai, us, hostdir);
+        const hostcfg = _optionalChain([$asai, 'access', _526 => _526.getHost, 'optionalCall', _527 => _527(hostdir)]) || {};
+        if (hostcfg.ckws) {
+          const existingWs = _optionalChain([$asai, 'access', _528 => _528.connectionsws, 'optionalAccess', _529 => _529[hostdir], 'optionalAccess', _530 => _530[us]]);
+          if (existingWs) {
+            const cleared = await clearStaleWsIfDead($asai, hostdir, us, existingWs);
+            if (!cleared) {
+              kickUserWs($asai, us, hostdir);
+            }
+          }
         }
         const quotaCheck = await canLogin($asai, us, hostdir);
         if (!quotaCheck.ok) {
@@ -4177,13 +4256,13 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
           opt
         );
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _512 => _512.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _531 => _531.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/user/login/logout/")) {
       try {
         const bodySid = body.sessionId ? sanitizeString(body.sessionId, 64) : "";
-        const us = _optionalChain([req, 'optionalAccess', _513 => _513.Userinfo, 'optionalAccess', _514 => _514[0]]);
+        const us = _optionalChain([req, 'optionalAccess', _532 => _532.Userinfo, 'optionalAccess', _533 => _533[0]]);
         if (bodySid) {
           if (!us) {
             return sendErr(res, "AUTH_MISSING", void 0, opt);
@@ -4197,7 +4276,7 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
         if (us) logSecurityEvent($asai, { type: "AUTH_SUCCESS", path: url, method: "POST", user: String(us), ip, detail: "logout" });
         return sendSuccess(res, "ok", opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _515 => _515.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _534 => _534.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/user/login/admin/kick/")) {
@@ -4215,7 +4294,7 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
         }
         kickUserWs($asai, target.us, hostdir);
         await store.removeSession(sessionId);
-        const operator = String(_optionalChain([req, 'optionalAccess', _516 => _516.Userinfo, 'optionalAccess', _517 => _517[0]]) || "");
+        const operator = String(_optionalChain([req, 'optionalAccess', _535 => _535.Userinfo, 'optionalAccess', _536 => _536[0]]) || "");
         await _chunkARHPHWT5cjs.logSessionTerminate.call(void 0, $asai, {
           operator,
           sessionId,
@@ -4224,7 +4303,7 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
         });
         return sendSuccess(res, { ok: true }, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _518 => _518.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _537 => _537.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/user/login/admin/delete/")) {
@@ -4236,11 +4315,11 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
         if (!targetUs || targetUs === "admin") return sendErr(res, "AUTH_FORBIDDEN", void 0, opt);
         const ok = await store.deleteUser(targetUs);
         if (!ok) return sendErr(res, "AUTH_USER_NOT_FOUND", void 0, opt);
-        const operator = String(_optionalChain([req, 'optionalAccess', _519 => _519.Userinfo, 'optionalAccess', _520 => _520[0]]) || "");
+        const operator = String(_optionalChain([req, 'optionalAccess', _538 => _538.Userinfo, 'optionalAccess', _539 => _539[0]]) || "");
         await _chunkARHPHWT5cjs.logAccountPurge.call(void 0, $asai, { operator, targetUs, ip });
         return sendSuccess(res, { ok: true }, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _521 => _521.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _540 => _540.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/user/login/admin/levels/")) {
@@ -4252,7 +4331,7 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
         const thresholds = body.thresholds && typeof body.thresholds === "object" ? body.thresholds : void 0;
         const routeRights = Array.isArray(body.routeRights) ? body.routeRights : void 0;
         const defaultResetPassword = typeof body.defaultResetPassword === "string" ? body.defaultResetPassword : void 0;
-        const operator = String(_optionalChain([req, 'optionalAccess', _522 => _522.Userinfo, 'optionalAccess', _523 => _523[0]]) || "");
+        const operator = String(_optionalChain([req, 'optionalAccess', _541 => _541.Userinfo, 'optionalAccess', _542 => _542[0]]) || "");
         const cfg = await _chunkGXOFLFFWcjs.saveUserLevelConfig.call(void 0, 
           $asai,
           {
@@ -4265,13 +4344,13 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
         );
         await _chunkARHPHWT5cjs.logSecurityConfigIntervention.call(void 0, $asai, {
           section: "user_levels",
-          detail: JSON.stringify({ levels: _optionalChain([levels, 'optionalAccess', _524 => _524.length]), thresholds: !!thresholds, routeRights: _optionalChain([routeRights, 'optionalAccess', _525 => _525.length]) }),
+          detail: JSON.stringify({ levels: _optionalChain([levels, 'optionalAccess', _543 => _543.length]), thresholds: !!thresholds, routeRights: _optionalChain([routeRights, 'optionalAccess', _544 => _544.length]) }),
           operator,
           ip
         });
         return sendSuccess(res, cfg, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _526 => _526.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _545 => _545.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/user/login/admin/resetpass/")) {
@@ -4305,7 +4384,7 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
           passHistory: "[]"
         });
         if (!updated) return sendErr(res, "AUTH_USER_NOT_FOUND", void 0, opt);
-        const operator = String(_optionalChain([req, 'optionalAccess', _527 => _527.Userinfo, 'optionalAccess', _528 => _528[0]]) || "");
+        const operator = String(_optionalChain([req, 'optionalAccess', _546 => _546.Userinfo, 'optionalAccess', _547 => _547[0]]) || "");
         await _chunkARHPHWT5cjs.logUserRbacChange.call(void 0, $asai, {
           operator,
           targetUs,
@@ -4322,7 +4401,7 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
         });
         return sendSuccess(res, { user: publicUser($asai, updated) }, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _529 => _529.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _548 => _548.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/user/login/admin/update/")) {
@@ -4353,7 +4432,7 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
         if (!updated) return sendErr(res, "AUTH_USER_NOT_FOUND", void 0, opt);
         if (Object.keys(patch).length) {
           await _chunkARHPHWT5cjs.logUserRbacChange.call(void 0, $asai, {
-            operator: String(_optionalChain([req, 'optionalAccess', _530 => _530.Userinfo, 'optionalAccess', _531 => _531[0]]) || ""),
+            operator: String(_optionalChain([req, 'optionalAccess', _549 => _549.Userinfo, 'optionalAccess', _550 => _550[0]]) || ""),
             targetUs,
             patch,
             ip
@@ -4361,11 +4440,11 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
         }
         return sendSuccess(res, { user: publicUser($asai, updated) }, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _532 => _532.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _551 => _551.message]) || err, opt);
       }
     }
     if (url.startsWith("/api/user/login/profile/")) {
-      const us = _optionalChain([req, 'optionalAccess', _533 => _533.Userinfo, 'optionalAccess', _534 => _534[0]]);
+      const us = _optionalChain([req, 'optionalAccess', _552 => _552.Userinfo, 'optionalAccess', _553 => _553[0]]);
       if (!us) return sendErr(res, "AUTH_UNAUTHORIZED", void 0, opt);
       try {
         const user = await store.findByUsername(String(us));
@@ -4399,7 +4478,7 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
         const fresh = await store.findByUsername(String(us));
         return sendSuccess(res, { user: fresh ? publicUser($asai, fresh) : null }, opt);
       } catch (err) {
-        return sendFail(res, _optionalChain([err, 'optionalAccess', _535 => _535.message]) || err, opt);
+        return sendFail(res, _optionalChain([err, 'optionalAccess', _554 => _554.message]) || err, opt);
       }
     }
   }
@@ -4408,7 +4487,7 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
     const url = req.url || "";
     const ip = getClientIp(req);
     if (url.startsWith("/api/user/login/config/")) {
-      const lang = String(_optionalChain([req, 'optionalAccess', _536 => _536.headers, 'optionalAccess', _537 => _537["accept-language"]]) || _optionalChain([opt, 'optionalAccess', _538 => _538.headers, 'optionalAccess', _539 => _539["accept-language"]]) || "zh-CN").split(",")[0];
+      const lang = String(_optionalChain([req, 'optionalAccess', _555 => _555.headers, 'optionalAccess', _556 => _556["accept-language"]]) || _optionalChain([opt, 'optionalAccess', _557 => _557.headers, 'optionalAccess', _558 => _558["accept-language"]]) || "zh-CN").split(",")[0];
       await _chunkGXOFLFFWcjs.loadUserLevelConfig.call(void 0, $asai);
       return sendSuccess(res, _chunkGXOFLFFWcjs.getPublicSecurityConfig.call(void 0, $asai, lang), opt);
     }
@@ -4469,7 +4548,7 @@ var login_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
       );
     }
     if (url.startsWith("/api/user/login/profile/")) {
-      const us = _optionalChain([req, 'optionalAccess', _540 => _540.Userinfo, 'optionalAccess', _541 => _541[0]]);
+      const us = _optionalChain([req, 'optionalAccess', _559 => _559.Userinfo, 'optionalAccess', _560 => _560[0]]);
       if (!us) return sendErr(res, "AUTH_UNAUTHORIZED", void 0, opt);
       const user = await store.findByUsername(String(us));
       return sendSuccess(res, { user: user ? publicUser($asai, user) : null }, opt);
@@ -4511,16 +4590,16 @@ var As_default = {
     return { code: 908, data: val };
   },
   ctxSuccess(val, opt = null) {
-    if (typeof _optionalChain([opt, 'optionalAccess', _542 => _542.resAES]) === "function") {
+    if (typeof _optionalChain([opt, 'optionalAccess', _561 => _561.resAES]) === "function") {
       val = opt.resAES(val);
     }
     return { code: 909, data: val };
   },
   getPath(str = "-") {
-    return _optionalChain([str, 'optionalAccess', _543 => _543.replace, 'call', _544 => _544(/[^a-zA-Z0-9.\-_\\\/]/g, "")]);
+    return _optionalChain([str, 'optionalAccess', _562 => _562.replace, 'call', _563 => _563(/[^a-zA-Z0-9.\-_\\\/]/g, "")]);
   },
   getName(str = "-") {
-    return _optionalChain([str, 'optionalAccess', _545 => _545.replace, 'call', _546 => _546(/[^a-zA-Z0-9.\-_]/g, "")]);
+    return _optionalChain([str, 'optionalAccess', _564 => _564.replace, 'call', _565 => _565(/[^a-zA-Z0-9.\-_]/g, "")]);
   },
   toDirPath(relativePath) {
     const pathArr = relativePath.split("/");
@@ -4591,7 +4670,7 @@ var As_default = {
   //     immediate: false,
   // });
   dtImmediate(fn, opt) {
-    if (_optionalChain([opt, 'optionalAccess', _547 => _547.immediate])) {
+    if (_optionalChain([opt, 'optionalAccess', _566 => _566.immediate])) {
       fn();
       opt.immediate = false;
     }
@@ -4613,7 +4692,7 @@ var As_default = {
     if (opt.endtime - opt.starttime < opt.wait) {
       this.dtClearTimeout(opt);
     }
-    if (!_optionalChain([opt, 'optionalAccess', _548 => _548.timeout])) {
+    if (!_optionalChain([opt, 'optionalAccess', _567 => _567.timeout])) {
       opt.starttime = opt.endtime;
       opt.timeout = this.dtSetTimeout(fn, opt);
     }
@@ -4621,7 +4700,7 @@ var As_default = {
   // 节流:指定长度时间内有多次触发，只fn最后一次触发
   throttle(fn, opt) {
     this.dtImmediate(fn, opt);
-    if (!_optionalChain([opt, 'optionalAccess', _549 => _549.timeout])) {
+    if (!_optionalChain([opt, 'optionalAccess', _568 => _568.timeout])) {
       opt.timeout = this.dtSetTimeout(fn, opt);
     }
   },
@@ -4657,8 +4736,8 @@ var As_default = {
 var AsCode_default = {
   // 加密
   asencode(str, keys) {
-    const strlen = _optionalChain([str, 'optionalAccess', _550 => _550.length]) || 0;
-    const keyslen = _optionalChain([keys, 'optionalAccess', _551 => _551.length]) || 0;
+    const strlen = _optionalChain([str, 'optionalAccess', _569 => _569.length]) || 0;
+    const keyslen = _optionalChain([keys, 'optionalAccess', _570 => _570.length]) || 0;
     let newstr = "";
     for (let i = 0; i < strlen; i++) {
       const rnum = Math.round(Math.random() * 1e3) % keyslen;
@@ -4683,7 +4762,7 @@ var AsCode_default = {
         const rnum = keys.indexOf(str[i + 3]);
         const rnumx = Number(rnum.toString().slice(-1)) + 1;
         const ylen = keyslen - rnumx;
-        newstr += _optionalChain([String, 'optionalAccess', _552 => _552.fromCodePoint, 'call', _553 => _553(
+        newstr += _optionalChain([String, 'optionalAccess', _571 => _571.fromCodePoint, 'call', _572 => _572(
           (keys.indexOf(str[i++]) - rnumx) * ylen * ylen + (keys.indexOf(str[i++]) - rnumx) * ylen + (keys.indexOf(str[i++]) - rnumx)
         )]);
       }
@@ -4730,7 +4809,7 @@ var AsAES_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
     if (typeof value !== "string") return value;
     try {
       return JSON.parse(value);
-    } catch (e40) {
+    } catch (e44) {
       return value;
     }
   }
@@ -4766,7 +4845,7 @@ var AsAES_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, decrypt, "decrypt");
   function validateFields(payload, fields) {
-    return fields.every((key) => typeof _optionalChain([payload, 'optionalAccess', _554 => _554[key]]) === "string" && payload[key].length > 0);
+    return fields.every((key) => typeof _optionalChain([payload, 'optionalAccess', _573 => _573[key]]) === "string" && payload[key].length > 0);
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, validateFields, "validateFields");
   function reqAES(opt, fn = (data) => data) {
@@ -4774,7 +4853,7 @@ var AsAES_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
     try {
       if (validateFields(reqData, ["data", "iv", "auth"])) {
         let aesData = decrypt(reqData);
-        if (_optionalChain([reqData, 'optionalAccess', _555 => _555.aes]) === 2) {
+        if (_optionalChain([reqData, 'optionalAccess', _574 => _574.aes]) === 2) {
           aesData = JSON.parse(aesData);
         }
         return fn(aesData);
@@ -4808,24 +4887,24 @@ var AsAES_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai
 // src/sysserver/lib/common/AsDb.ts
 var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai, cfg) => {
   const DataServer = _chunk2BCIIKRGcjs.getDataServerForAsDb.call(void 0, $asai, {
-    type: _optionalChain([cfg, 'optionalAccess', _556 => _556.type]) || "sqlite",
+    type: _optionalChain([cfg, 'optionalAccess', _575 => _575.type]) || "sqlite",
     opt: {
-      ..._optionalChain([cfg, 'optionalAccess', _557 => _557.opt]) || {
+      ..._optionalChain([cfg, 'optionalAccess', _576 => _576.opt]) || {
         database: "./webdata/webdb/sqlite/asaisqlite.db",
         create: 1
       }
     },
-    storeKey: _optionalChain([cfg, 'optionalAccess', _558 => _558.storeKey])
+    storeKey: _optionalChain([cfg, 'optionalAccess', _577 => _577.storeKey])
   });
   function reqwherestr(str) {
-    if (_optionalChain([cfg, 'optionalAccess', _559 => _559.type]) === "sqlite" || _optionalChain([cfg, 'optionalAccess', _560 => _560.type]) === "mysql") {
+    if (_optionalChain([cfg, 'optionalAccess', _578 => _578.type]) === "sqlite" || _optionalChain([cfg, 'optionalAccess', _579 => _579.type]) === "mysql") {
       return `'${str}'`;
     }
     return str;
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, reqwherestr, "reqwherestr");
   function reqfield(queryData) {
-    if (_optionalChain([queryData, 'optionalAccess', _561 => _561.fd])) {
+    if (_optionalChain([queryData, 'optionalAccess', _580 => _580.fd])) {
       return queryData.fd.split("-");
     }
     return cfg.field.data;
@@ -4833,14 +4912,14 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
   _chunkSMVZ3ZDJcjs.__name.call(void 0, reqfield, "reqfield");
   function reqwhere(queryData) {
     const wheretmp = [];
-    if ((_optionalChain([cfg, 'optionalAccess', _562 => _562.type]) === "sqlite" || _optionalChain([cfg, 'optionalAccess', _563 => _563.type]) === "mysql") && _optionalChain([queryData, 'optionalAccess', _564 => _564.wlv])) {
+    if ((_optionalChain([cfg, 'optionalAccess', _581 => _581.type]) === "sqlite" || _optionalChain([cfg, 'optionalAccess', _582 => _582.type]) === "mysql") && _optionalChain([queryData, 'optionalAccess', _583 => _583.wlv])) {
       const wlvarr = queryData.wlv.split("-");
       wheretmp.push([wlvarr[0], ">", Number(wlvarr[1] || 0)]);
     }
-    if (_optionalChain([queryData, 'optionalAccess', _565 => _565.fl])) {
+    if (_optionalChain([queryData, 'optionalAccess', _584 => _584.fl])) {
       wheretmp.push([cfg.field.class, "LIKE", reqwherestr(`${queryData.fl}%`)]);
     }
-    if (_optionalChain([queryData, 'optionalAccess', _566 => _566.ss]) && _optionalChain([queryData, 'optionalAccess', _567 => _567.ssty])) {
+    if (_optionalChain([queryData, 'optionalAccess', _585 => _585.ss]) && _optionalChain([queryData, 'optionalAccess', _586 => _586.ssty])) {
       wheretmp.push([queryData.ssty, "LIKE", reqwherestr(`%${queryData.ss}%`)]);
     }
     if (wheretmp.length > 1) {
@@ -4851,16 +4930,16 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
   _chunkSMVZ3ZDJcjs.__name.call(void 0, reqwhere, "reqwhere");
   function reqorder(queryData) {
     const ordertmp = [];
-    if (_optionalChain([queryData, 'optionalAccess', _568 => _568.sx])) {
-      ordertmp.push([queryData.sx, _optionalChain([queryData, 'optionalAccess', _569 => _569.sxty]) == 1 ? "DESC" : "ASC"]);
+    if (_optionalChain([queryData, 'optionalAccess', _587 => _587.sx])) {
+      ordertmp.push([queryData.sx, _optionalChain([queryData, 'optionalAccess', _588 => _588.sxty]) == 1 ? "DESC" : "ASC"]);
     }
     return ordertmp;
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, reqorder, "reqorder");
   function reqlimit(queryData) {
     let limittmp = "";
-    let limitps = _optionalChain([queryData, 'optionalAccess', _570 => _570.ps]);
-    if (_optionalChain([queryData, 'optionalAccess', _571 => _571.pg])) {
+    let limitps = _optionalChain([queryData, 'optionalAccess', _589 => _589.ps]);
+    if (_optionalChain([queryData, 'optionalAccess', _590 => _590.pg])) {
       limitps = limitps || 20;
       limittmp = `${(queryData.pg - 1) * limitps},${limitps}`;
     } else if (limitps) {
@@ -4872,7 +4951,7 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
   function decodePathSegment(seg) {
     try {
       return decodeURIComponent(seg);
-    } catch (e41) {
+    } catch (e45) {
       return seg;
     }
   }
@@ -4888,7 +4967,7 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
     if (typeof body === "string") {
       try {
         body = JSON.parse(body);
-      } catch (e42) {
+      } catch (e46) {
         return { content: body };
       }
     }
@@ -4913,8 +4992,8 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
   _chunkSMVZ3ZDJcjs.__name.call(void 0, fileKeyFromSegment, "fileKeyFromSegment");
   function getSqlParamsByUrl(req, opt) {
     let tmpSqlParams;
-    const reqArr = _optionalChain([req, 'optionalAccess', _572 => _572.url, 'optionalAccess', _573 => _573.split, 'call', _574 => _574("?"), 'access', _575 => _575[0], 'optionalAccess', _576 => _576.split, 'call', _577 => _577("/")]) || [];
-    const table = (_optionalChain([opt, 'optionalAccess', _578 => _578.qrdata, 'optionalAccess', _579 => _579.table]) || _optionalChain([opt, 'optionalAccess', _580 => _580.data, 'optionalAccess', _581 => _581.table]) || reqArr[3]).replaceAll("_", "/");
+    const reqArr = _optionalChain([req, 'optionalAccess', _591 => _591.url, 'optionalAccess', _592 => _592.split, 'call', _593 => _593("?"), 'access', _594 => _594[0], 'optionalAccess', _595 => _595.split, 'call', _596 => _596("/")]) || [];
+    const table = (_optionalChain([opt, 'optionalAccess', _597 => _597.qrdata, 'optionalAccess', _598 => _598.table]) || _optionalChain([opt, 'optionalAccess', _599 => _599.data, 'optionalAccess', _600 => _600.table]) || reqArr[3]).replaceAll("_", "/");
     if (!table) return tmpSqlParams;
     tmpSqlParams = {
       type: "select",
@@ -4923,7 +5002,7 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
     if (reqArr[5]) {
       if (reqArr[4] === "insert") {
         tmpSqlParams.type = reqArr[4];
-        if (_optionalChain([cfg, 'optionalAccess', _582 => _582.type]) === "file") {
+        if (_optionalChain([cfg, 'optionalAccess', _601 => _601.type]) === "file") {
           const { name: bodyName, content } = parseFileBody(opt.data);
           const fileKey = fileKeyFromSegment(reqArr[5], bodyName);
           tmpSqlParams.field = cfg.field.data;
@@ -4947,11 +5026,11 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
         }
       } else if (reqArr[4] === "update") {
         tmpSqlParams.type = reqArr[4];
-        const rowKey = _optionalChain([cfg, 'optionalAccess', _583 => _583.type]) === "file" ? fileKeyFromSegment(reqArr[5]) : decodePathSegment(reqArr[5]);
+        const rowKey = _optionalChain([cfg, 'optionalAccess', _602 => _602.type]) === "file" ? fileKeyFromSegment(reqArr[5]) : decodePathSegment(reqArr[5]);
         tmpSqlParams.where = [[cfg.field.key, "=", reqwherestr(rowKey)]];
-        if (_optionalChain([cfg, 'optionalAccess', _584 => _584.type]) === "file") {
+        if (_optionalChain([cfg, 'optionalAccess', _603 => _603.type]) === "file") {
           const { content } = parseFileBody(opt.data);
-          const contentField = _optionalChain([cfg, 'access', _585 => _585.field, 'access', _586 => _586.data, 'optionalAccess', _587 => _587[1]]) || "content";
+          const contentField = _optionalChain([cfg, 'access', _604 => _604.field, 'access', _605 => _605.data, 'optionalAccess', _606 => _606[1]]) || "content";
           tmpSqlParams.set = [[contentField, fileContentString(content)]];
         } else {
           tmpSqlParams.set = [];
@@ -4968,18 +5047,18 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
         }
       } else if (reqArr[4] === "delete") {
         tmpSqlParams.type = reqArr[4];
-        const rowKey = _optionalChain([cfg, 'optionalAccess', _588 => _588.type]) === "file" ? fileKeyFromSegment(reqArr[5]) : decodePathSegment(reqArr[5]);
+        const rowKey = _optionalChain([cfg, 'optionalAccess', _607 => _607.type]) === "file" ? fileKeyFromSegment(reqArr[5]) : decodePathSegment(reqArr[5]);
         tmpSqlParams.where = [[cfg.field.key, "=", reqwherestr(rowKey)]];
       } else {
-        if (_optionalChain([cfg, 'optionalAccess', _589 => _589.as]) > 1) {
+        if (_optionalChain([cfg, 'optionalAccess', _608 => _608.as]) > 1) {
           tmpSqlParams.as = +cfg.as - 1;
         }
         tmpSqlParams.field = cfg.field.data;
-        const rowKey = _optionalChain([cfg, 'optionalAccess', _590 => _590.type]) === "file" ? fileKeyFromSegment(reqArr[5]) : decodePathSegment(reqArr[5]);
+        const rowKey = _optionalChain([cfg, 'optionalAccess', _609 => _609.type]) === "file" ? fileKeyFromSegment(reqArr[5]) : decodePathSegment(reqArr[5]);
         tmpSqlParams.where = [[cfg.field.key, "=", reqwherestr(rowKey)]];
       }
     } else {
-      tmpSqlParams.as = _optionalChain([cfg, 'optionalAccess', _591 => _591.as]);
+      tmpSqlParams.as = _optionalChain([cfg, 'optionalAccess', _610 => _610.as]);
       tmpSqlParams.field = reqfield(opt.data);
       tmpSqlParams.where = reqwhere(opt.data);
       tmpSqlParams.order = reqorder(opt.data);
@@ -4989,8 +5068,8 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, getSqlParamsByUrl, "getSqlParamsByUrl");
   function dbFresh(req, resdb) {
-    if (_optionalChain([req, 'optionalAccess', _592 => _592.url, 'optionalAccess', _593 => _593.includes, 'call', _594 => _594("/selectlist/")])) {
-      const list = Array.isArray(resdb) ? resdb : _optionalChain([resdb, 'optionalAccess', _595 => _595.data]);
+    if (_optionalChain([req, 'optionalAccess', _611 => _611.url, 'optionalAccess', _612 => _612.includes, 'call', _613 => _613("/selectlist/")])) {
+      const list = Array.isArray(resdb) ? resdb : _optionalChain([resdb, 'optionalAccess', _614 => _614.data]);
       if (Array.isArray(list)) {
         const names = list.map((el) => {
           if (typeof el === "string") {
@@ -5012,8 +5091,8 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, dbFresh, "dbFresh");
   function normalizeFileSelectRow(row) {
-    const nameKey = _optionalChain([cfg, 'access', _596 => _596.field, 'optionalAccess', _597 => _597.data, 'optionalAccess', _598 => _598[0]]) || "name";
-    const contentKey = _optionalChain([cfg, 'access', _599 => _599.field, 'optionalAccess', _600 => _600.data, 'optionalAccess', _601 => _601[1]]) || "content";
+    const nameKey = _optionalChain([cfg, 'access', _615 => _615.field, 'optionalAccess', _616 => _616.data, 'optionalAccess', _617 => _617[0]]) || "name";
+    const contentKey = _optionalChain([cfg, 'access', _618 => _618.field, 'optionalAccess', _619 => _619.data, 'optionalAccess', _620 => _620[1]]) || "content";
     if (!row || typeof row !== "object") return row;
     const out = { ...row };
     if (out[nameKey] != null) {
@@ -5027,7 +5106,7 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, normalizeFileSelectRow, "normalizeFileSelectRow");
   function isFileSingleNameSelect(params) {
-    return _optionalChain([cfg, 'optionalAccess', _602 => _602.type]) === "file" && _optionalChain([params, 'optionalAccess', _603 => _603.type]) === "select" && !!_optionalChain([params, 'optionalAccess', _604 => _604.where, 'optionalAccess', _605 => _605.length]);
+    return _optionalChain([cfg, 'optionalAccess', _621 => _621.type]) === "file" && _optionalChain([params, 'optionalAccess', _622 => _622.type]) === "select" && !!_optionalChain([params, 'optionalAccess', _623 => _623.where, 'optionalAccess', _624 => _624.length]);
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, isFileSingleNameSelect, "isFileSingleNameSelect");
   function normalizeSelectResult(params, resdb) {
@@ -5041,12 +5120,12 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
       }
       return data;
     }
-    if (_optionalChain([params, 'optionalAccess', _606 => _606.where, 'optionalAccess', _607 => _607.length]) && Array.isArray(data) && data.length === 1) {
+    if (_optionalChain([params, 'optionalAccess', _625 => _625.where, 'optionalAccess', _626 => _626.length]) && Array.isArray(data) && data.length === 1) {
       data = data[0];
     }
-    if (_optionalChain([cfg, 'optionalAccess', _608 => _608.type]) === "file" && data && typeof data === "object" && !Array.isArray(data)) {
-      const nameKey = _optionalChain([cfg, 'access', _609 => _609.field, 'optionalAccess', _610 => _610.data, 'optionalAccess', _611 => _611[0]]) || "name";
-      const contentKey = _optionalChain([cfg, 'access', _612 => _612.field, 'optionalAccess', _613 => _613.data, 'optionalAccess', _614 => _614[1]]) || "content";
+    if (_optionalChain([cfg, 'optionalAccess', _627 => _627.type]) === "file" && data && typeof data === "object" && !Array.isArray(data)) {
+      const nameKey = _optionalChain([cfg, 'access', _628 => _628.field, 'optionalAccess', _629 => _629.data, 'optionalAccess', _630 => _630[0]]) || "name";
+      const contentKey = _optionalChain([cfg, 'access', _631 => _631.field, 'optionalAccess', _632 => _632.data, 'optionalAccess', _633 => _633[1]]) || "content";
       if (data[nameKey] != null) {
         data[nameKey] = bareFileName(String(data[nameKey]));
       }
@@ -5056,7 +5135,7 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
         if (text.startsWith("{") || text.startsWith("[")) {
           try {
             data[contentKey] = JSON.parse(text);
-          } catch (e43) {
+          } catch (e47) {
           }
         }
       }
@@ -5065,7 +5144,7 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, normalizeSelectResult, "normalizeSelectResult");
   function dbCodePm(req, resdb) {
-    if (_optionalChain([req, 'optionalAccess', _615 => _615.Userinfo]) && _optionalChain([req, 'optionalAccess', _616 => _616.Userinfo, 'access', _617 => _617[2]])) {
+    if (_optionalChain([req, 'optionalAccess', _634 => _634.Userinfo]) && _optionalChain([req, 'optionalAccess', _635 => _635.Userinfo, 'access', _636 => _636[2]])) {
       if (resdb != null && typeof resdb === "object") {
         resdb.data = $asai.$lib.AsCode.asencode(JSON.stringify(resdb.data), req.Userinfo[2]);
       }
@@ -5079,8 +5158,8 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
       DataServer.sqlDb(params).then((resdb) => {
         res.end(JSON.stringify($asai.$lib.As.ctxSuccess(dbCodePm(req, dbFresh(req, resdb)), opt)));
       }).catch((errdb) => {
-        const msg = String(_optionalChain([errdb, 'optionalAccess', _618 => _618.message]) || errdb || "");
-        if (_optionalChain([params, 'optionalAccess', _619 => _619.type]) === "select" && msg.includes("no such table")) {
+        const msg = String(_optionalChain([errdb, 'optionalAccess', _637 => _637.message]) || errdb || "");
+        if (_optionalChain([params, 'optionalAccess', _638 => _638.type]) === "select" && msg.includes("no such table")) {
           res.end(JSON.stringify($asai.$lib.As.ctxSuccess([], opt)));
           return;
         }
@@ -5097,29 +5176,29 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
       try {
         DataServer.sqlDb(params).then((resdb) => {
           let resData = normalizeSelectResult(params, dbFresh(req, resdb));
-          if (_optionalChain([params, 'optionalAccess', _620 => _620.as]) === 2 && _optionalChain([params, 'optionalAccess', _621 => _621.field, 'optionalAccess', _622 => _622.length]) > 1) {
+          if (_optionalChain([params, 'optionalAccess', _639 => _639.as]) === 2 && _optionalChain([params, 'optionalAccess', _640 => _640.field, 'optionalAccess', _641 => _641.length]) > 1) {
             let limitArr = [];
-            if (_optionalChain([params, 'access', _623 => _623.limit, 'optionalAccess', _624 => _624.split, 'call', _625 => _625(","), 'optionalAccess', _626 => _626.length]) < 2) {
-              limitArr = [0, +_optionalChain([params, 'access', _627 => _627.limit, 'optionalAccess', _628 => _628.split, 'call', _629 => _629(","), 'optionalAccess', _630 => _630[0]])];
+            if (_optionalChain([params, 'access', _642 => _642.limit, 'optionalAccess', _643 => _643.split, 'call', _644 => _644(","), 'optionalAccess', _645 => _645.length]) < 2) {
+              limitArr = [0, +_optionalChain([params, 'access', _646 => _646.limit, 'optionalAccess', _647 => _647.split, 'call', _648 => _648(","), 'optionalAccess', _649 => _649[0]])];
             } else {
               limitArr = params.limit.split(",");
               limitArr = [+limitArr[0], +limitArr[0] + +limitArr[1]];
             }
-            if (_optionalChain([resData, 'access', _631 => _631.data, 'optionalAccess', _632 => _632.length])) {
+            if (_optionalChain([resData, 'access', _650 => _650.data, 'optionalAccess', _651 => _651.length])) {
               resData.data = resData.data.slice(+limitArr[0], +limitArr[1]);
             }
           }
           resData = dbCodePm(req, resData);
           res.end(JSON.stringify($asai.$lib.As.ctxSuccess(resData, opt)));
         }).catch((errdb) => {
-          const msg = String(_optionalChain([errdb, 'optionalAccess', _633 => _633.message]) || errdb || "");
-          if (_optionalChain([params, 'optionalAccess', _634 => _634.type]) === "select" && msg.includes("no such table")) {
+          const msg = String(_optionalChain([errdb, 'optionalAccess', _652 => _652.message]) || errdb || "");
+          if (_optionalChain([params, 'optionalAccess', _653 => _653.type]) === "select" && msg.includes("no such table")) {
             res.end(JSON.stringify($asai.$lib.As.ctxSuccess([], opt)));
             return;
           }
           res.end(JSON.stringify($asai.$lib.As.ctxFail(errdb)));
         });
-      } catch (e44) {
+      } catch (e48) {
         res.end(JSON.stringify({ code: 901 }));
       }
     } else {
@@ -5128,7 +5207,7 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, runDefaultGet, "runDefaultGet");
   function post(req, res, hostdir, opt) {
-    if (_optionalChain([cfg, 'optionalAccess', _635 => _635.post]) && typeof cfg.post === "function") {
+    if (_optionalChain([cfg, 'optionalAccess', _654 => _654.post]) && typeof cfg.post === "function") {
       Promise.resolve(cfg.post(req, res, hostdir, opt, DataServer)).then((reqstat) => {
         if (!reqstat) runDefaultPost(req, res, opt);
       }).catch((errdb) => {
@@ -5140,7 +5219,7 @@ var AsDb_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($asai,
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, post, "post");
   function get(req, res, hostdir, opt) {
-    if (_optionalChain([cfg, 'optionalAccess', _636 => _636.get]) && typeof cfg.get === "function") {
+    if (_optionalChain([cfg, 'optionalAccess', _655 => _655.get]) && typeof cfg.get === "function") {
       Promise.resolve(cfg.get(req, res, hostdir, opt, DataServer)).then((reqstat) => {
         if (!reqstat) runDefaultGet(req, res, opt);
       }).catch((errdb) => {
@@ -5166,7 +5245,7 @@ var reqWork_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($as
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, hostDefault2, "hostDefault");
   function getPathFromOpt(opt) {
-    const rawPath = _optionalChain([opt, 'access', _637 => _637.qrdata, 'optionalAccess', _638 => _638.path]) || _optionalChain([opt, 'access', _639 => _639.data, 'optionalAccess', _640 => _640.path]);
+    const rawPath = _optionalChain([opt, 'access', _656 => _656.qrdata, 'optionalAccess', _657 => _657.path]) || _optionalChain([opt, 'access', _658 => _658.data, 'optionalAccess', _659 => _659.path]);
     if (!rawPath) {
       throw new Error("Missing path");
     }
@@ -5175,7 +5254,7 @@ var reqWork_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($as
       return path4.normalize(decoded);
     }
     const rel = decoded.replace(/^\.(\/)?/, "");
-    const serverRoot = _optionalChain([$asai, 'optionalAccess', _641 => _641.serverRoot]);
+    const serverRoot = _optionalChain([$asai, 'optionalAccess', _660 => _660.serverRoot]);
     if (serverRoot && rel) {
       const absRoot = path4.resolve(serverRoot);
       const abs = path4.resolve(absRoot, rel);
@@ -5184,12 +5263,12 @@ var reqWork_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($as
         return abs;
       }
     }
-    const roots = _optionalChain([$asai, 'optionalAccess', _642 => _642.asaihost, 'optionalAccess', _643 => _643.getHostAllowedRoots, 'optionalCall', _644 => _644(_optionalChain([$asai, 'optionalAccess', _645 => _645.hostconfig]))]) || [];
+    const roots = _optionalChain([$asai, 'optionalAccess', _661 => _661.asaihost, 'optionalAccess', _662 => _662.getHostAllowedRoots, 'optionalCall', _663 => _663(_optionalChain([$asai, 'optionalAccess', _664 => _664.hostconfig]))]) || [];
     if (!roots.length) {
-      const fallback = _optionalChain([$asai, 'optionalAccess', _646 => _646.serverRoot]) || process.cwd();
+      const fallback = _optionalChain([$asai, 'optionalAccess', _665 => _665.serverRoot]) || process.cwd();
       if (fallback) roots.push(fallback);
     }
-    if (!_optionalChain([$asai, 'optionalAccess', _647 => _647.asaihost, 'optionalAccess', _648 => _648.resolvePathUnderRoots])) {
+    if (!_optionalChain([$asai, 'optionalAccess', _666 => _666.asaihost, 'optionalAccess', _667 => _667.resolvePathUnderRoots])) {
       throw new Error("Path resolver unavailable");
     }
     return $asai.asaihost.resolvePathUnderRoots(decoded, roots);
@@ -5201,18 +5280,18 @@ var reqWork_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($as
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, sendSuccess, "sendSuccess");
   function sendErr(res, ec, params, opt) {
-    const ErrorCode = _optionalChain([$asai, 'access', _649 => _649.$lib, 'optionalAccess', _650 => _650.ErrorCode]);
-    _optionalChain([ErrorCode, 'optionalAccess', _651 => _651.loadErrorCodes, 'optionalCall', _652 => _652($asai)]);
-    _optionalChain([ErrorCode, 'optionalAccess', _653 => _653.logError, 'optionalCall', _654 => _654($asai, ec, Array.isArray(params) ? params.map(String) : params != null ? [String(params)] : void 0)]);
+    const ErrorCode = _optionalChain([$asai, 'access', _668 => _668.$lib, 'optionalAccess', _669 => _669.ErrorCode]);
+    _optionalChain([ErrorCode, 'optionalAccess', _670 => _670.loadErrorCodes, 'optionalCall', _671 => _671($asai)]);
+    _optionalChain([ErrorCode, 'optionalAccess', _672 => _672.logError, 'optionalCall', _673 => _673($asai, ec, Array.isArray(params) ? params.map(String) : params != null ? [String(params)] : void 0)]);
     const response = $asai.$lib.As.ctxErr(ec, params, opt);
     res.end(JSON.stringify(response));
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, sendErr, "sendErr");
   function sendFail(res, err, opt) {
-    const ErrorCode = _optionalChain([$asai, 'access', _655 => _655.$lib, 'optionalAccess', _656 => _656.ErrorCode]);
-    _optionalChain([ErrorCode, 'optionalAccess', _657 => _657.loadErrorCodes, 'optionalCall', _658 => _658($asai)]);
-    const normalized = _optionalChain([ErrorCode, 'optionalAccess', _659 => _659.normalizeErrPayload, 'optionalCall', _660 => _660(err)]);
-    if (_optionalChain([normalized, 'optionalAccess', _661 => _661.ec])) {
+    const ErrorCode = _optionalChain([$asai, 'access', _674 => _674.$lib, 'optionalAccess', _675 => _675.ErrorCode]);
+    _optionalChain([ErrorCode, 'optionalAccess', _676 => _676.loadErrorCodes, 'optionalCall', _677 => _677($asai)]);
+    const normalized = _optionalChain([ErrorCode, 'optionalAccess', _678 => _678.normalizeErrPayload, 'optionalCall', _679 => _679(err)]);
+    if (_optionalChain([normalized, 'optionalAccess', _680 => _680.ec])) {
       return sendErr(res, normalized.ec, normalized.pm, opt);
     }
     const response = $asai.$lib.As.ctxFail(err);
@@ -5220,7 +5299,7 @@ var reqWork_default = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, ($as
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, sendFail, "sendFail");
   function mnLog(...arg) {
-    (_optionalChain([$asai, 'optionalAccess', _662 => _662.$log]) || console.log)(...arg);
+    (_optionalChain([$asai, 'optionalAccess', _681 => _681.$log]) || console.log)(...arg);
   }
   _chunkSMVZ3ZDJcjs.__name.call(void 0, mnLog, "mnLog");
   return { hostDefault: hostDefault2, getPathFromOpt, sendSuccess, sendFail, sendErr, mnLog };
@@ -5253,7 +5332,7 @@ async function pathExists(filePath) {
   try {
     await _promises2.default.access(nodePath2.default.normalize(filePath));
     return true;
-  } catch (e45) {
+  } catch (e49) {
     return false;
   }
 }
@@ -5320,7 +5399,7 @@ async function removeFile(filePath) {
   try {
     await _promises2.default.unlink(nodePath2.default.normalize(filePath));
   } catch (err) {
-    if (_optionalChain([err, 'optionalAccess', _663 => _663.code]) !== "ENOENT") throw err;
+    if (_optionalChain([err, 'optionalAccess', _682 => _682.code]) !== "ENOENT") throw err;
   }
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, removeFile, "removeFile");
@@ -5632,11 +5711,11 @@ function dbDriver(opt = {}) {
       this.fileExt = config.ext === ".*" ? "" : config.ext || "";
       this.fileDel = (config.del || 0) !== 0;
       this.createDir = config.create || false;
-      const root = _optionalChain([config, 'access', _664 => _664.$asai, 'optionalAccess', _665 => _665.serverRoot]) || _chunkHR5JKN7Ycjs.getPrimaryServerRoot.call(void 0, );
+      const root = _optionalChain([config, 'access', _683 => _683.$asai, 'optionalAccess', _684 => _684.serverRoot]) || _chunkHR5JKN7Ycjs.getPrimaryServerRoot.call(void 0, );
       this.baseDirAbs = path7.resolve(root, config.dir);
     }
     dbLog(...args) {
-      (_optionalChain([this, 'access', _666 => _666.config, 'optionalAccess', _667 => _667.$asai, 'optionalAccess', _668 => _668.$log]) || console.log)("FILE", ...args);
+      (_optionalChain([this, 'access', _685 => _685.config, 'optionalAccess', _686 => _686.$asai, 'optionalAccess', _687 => _687.$log]) || console.log)("FILE", ...args);
     }
     checkFile(file) {
       return fs10.existsSync(this.getAbsPath(file, false));
@@ -5702,7 +5781,7 @@ function dbDriver(opt = {}) {
     }
     getReadPath(file, sql) {
       const candidates = [];
-      if (_optionalChain([sql, 'optionalAccess', _669 => _669.filename])) {
+      if (_optionalChain([sql, 'optionalAccess', _688 => _688.filename])) {
         candidates.push({ dir: path7.join(file, sql.filename) });
         candidates.push({ dir: path7.join(file + ".delete" + this.fileExt, sql.filename) });
       } else {
@@ -5722,20 +5801,20 @@ function dbDriver(opt = {}) {
       if (!read2.path) {
         return { path: "", dir: read2.dir };
       }
-      if (_optionalChain([sql, 'optionalAccess', _670 => _670.filename])) {
+      if (_optionalChain([sql, 'optionalAccess', _689 => _689.filename])) {
         return { path: path7.dirname(read2.path), dir: path7.dirname(read2.dir) };
       }
       return { path: read2.path, dir: read2.dir };
     }
     getNewPath(file, sql) {
-      if (_optionalChain([sql, 'optionalAccess', _671 => _671.filename])) {
+      if (_optionalChain([sql, 'optionalAccess', _690 => _690.filename])) {
         return this.getAbsPath(path7.join(file, sql.filename), true);
       }
       return this.getAbsPath(file, true);
     }
     write(file, data, sql) {
       try {
-        const filePath = _optionalChain([sql, 'optionalAccess', _672 => _672.type]) === "insert" ? this.getNewPath(file, sql) : this.getReadPath(file, sql).path || this.getNewPath(file, sql);
+        const filePath = _optionalChain([sql, 'optionalAccess', _691 => _691.type]) === "insert" ? this.getNewPath(file, sql) : this.getReadPath(file, sql).path || this.getNewPath(file, sql);
         this.dbLog("write", "[WRITE]", filePath);
         fs10.writeFileSync(filePath, data, "utf8");
         return "ok";
@@ -5765,11 +5844,11 @@ function dbDriver(opt = {}) {
         if (!del.path) {
           return "";
         }
-        if (this.fileDel && _optionalChain([sql, 'optionalAccess', _673 => _673.deltrue])) {
+        if (this.fileDel && _optionalChain([sql, 'optionalAccess', _692 => _692.deltrue])) {
           const target = del.path + ".delete" + this.fileExt;
           this.dbLog("soft delete", "[SOFT DELETE]", `${del.path} -> ${target}`);
           fs10.renameSync(del.path, target);
-        } else if (_optionalChain([sql, 'optionalAccess', _674 => _674.filename])) {
+        } else if (_optionalChain([sql, 'optionalAccess', _693 => _693.filename])) {
           this.deldir(del.dir);
         } else {
           this.dbLog("delete", "[DELETE]", del.path);
@@ -5811,8 +5890,8 @@ function dbDriver(opt = {}) {
         let entries;
         try {
           entries = fs10.readdirSync(absDir, { withFileTypes: true });
-        } catch (e46) {
-          return _optionalChain([sql, 'optionalAccess', _675 => _675.list]) ? { open: [], delete: [] } : [];
+        } catch (e50) {
+          return _optionalChain([sql, 'optionalAccess', _694 => _694.list]) ? { open: [], delete: [] } : [];
         }
         const result = { open: [], delete: [] };
         const deleteSuffix = ".delete" + this.fileExt;
@@ -5827,14 +5906,14 @@ function dbDriver(opt = {}) {
             const data = fs10.readFileSync(fullPath, "utf8");
             const entryData = { data, file: baseName };
             if (isDelete) {
-              if (_optionalChain([sql, 'optionalAccess', _676 => _676.list])) result.delete.push(entryData);
+              if (_optionalChain([sql, 'optionalAccess', _695 => _695.list])) result.delete.push(entryData);
             } else {
               result.open.push(entryData);
             }
-          } catch (e47) {
+          } catch (e51) {
           }
         }
-        return _optionalChain([sql, 'optionalAccess', _677 => _677.list]) ? result : result.open;
+        return _optionalChain([sql, 'optionalAccess', _696 => _696.list]) ? result : result.open;
       } catch (e) {
         this.dbLog("list failed", "[LIST ERROR]", e);
         return e;
@@ -5844,7 +5923,7 @@ function dbDriver(opt = {}) {
     getFileNameFromWhere(where) {
       if (!where || !Array.isArray(where)) return "";
       const first = where.find((item) => Array.isArray(item));
-      const raw = _optionalChain([first, 'optionalAccess', _678 => _678[2]]);
+      const raw = _optionalChain([first, 'optionalAccess', _697 => _697[2]]);
       if (typeof raw === "string") {
         return raw.replace(/^'+|'+$/g, "");
       }
@@ -5869,22 +5948,22 @@ function dbDriver(opt = {}) {
             const data = sql.set[0][1];
             result = this.write(this.tableFilePath(sql.table, file), data, sql);
           } else if (sql.type === "select") {
-            if (_optionalChain([sql, 'optionalAccess', _679 => _679.where, 'optionalAccess', _680 => _680.length]) && _optionalChain([sql, 'optionalAccess', _681 => _681.as]) !== 2) {
+            if (_optionalChain([sql, 'optionalAccess', _698 => _698.where, 'optionalAccess', _699 => _699.length]) && _optionalChain([sql, 'optionalAccess', _700 => _700.as]) !== 2) {
               const file = this.getFileNameFromWhere(sql.where);
               const readRes = this.read(this.tableFilePath(sql.table, file), sql);
               const resObj = {};
-              if (_optionalChain([readRes, 'optionalAccess', _682 => _682[0], 'optionalAccess', _683 => _683.file]) && !readRes.error) {
+              if (_optionalChain([readRes, 'optionalAccess', _701 => _701[0], 'optionalAccess', _702 => _702.file]) && !readRes.error) {
                 if (sql.as === 1) {
                   try {
                     const parsed = JSON.parse(readRes[0].data);
-                    if (_optionalChain([sql, 'access', _684 => _684.field, 'optionalAccess', _685 => _685.length])) {
+                    if (_optionalChain([sql, 'access', _703 => _703.field, 'optionalAccess', _704 => _704.length])) {
                       sql.field.forEach((f) => {
                         resObj[f] = _nullishCoalesce(parsed[f], () => ( ""));
                       });
                     } else {
                       Object.assign(resObj, parsed);
                     }
-                  } catch (e48) {
+                  } catch (e52) {
                   }
                 } else {
                   const fields = sql.field;
@@ -5898,7 +5977,7 @@ function dbDriver(opt = {}) {
             } else {
               const listRes = this.list(tableDir, sql);
               if (listRes && !listRes.error) {
-                if (_optionalChain([sql, 'optionalAccess', _686 => _686.list])) {
+                if (_optionalChain([sql, 'optionalAccess', _705 => _705.list])) {
                   const mapEntry = /* @__PURE__ */ _chunkSMVZ3ZDJcjs.__name.call(void 0, (el) => {
                     const fields = sql.field;
                     const item = { [fields[0]]: el.file };
@@ -5909,9 +5988,9 @@ function dbDriver(opt = {}) {
                   if (listRes.delete) listRes.delete = listRes.delete.map(mapEntry);
                   result = listRes;
                 } else {
-                  if (_optionalChain([sql, 'optionalAccess', _687 => _687.as]) === 2) {
+                  if (_optionalChain([sql, 'optionalAccess', _706 => _706.as]) === 2) {
                     let items = listRes;
-                    if (_optionalChain([sql, 'access', _688 => _688.where, 'optionalAccess', _689 => _689.length])) {
+                    if (_optionalChain([sql, 'access', _707 => _707.where, 'optionalAccess', _708 => _708.length])) {
                       const where = sql.where;
                       const whereType = typeof where[0] === "string" ? where[0] : "and";
                       items = items.filter((el) => {
@@ -5925,7 +6004,7 @@ function dbDriver(opt = {}) {
                           let fieldVal = "";
                           try {
                             fieldVal = _nullishCoalesce(JSON.parse(el.data)[field], () => ( ""));
-                          } catch (e49) {
+                          } catch (e53) {
                           }
                           const condMatch = String(fieldVal).includes(searchVal);
                           if (whereType === "and") {
@@ -5943,18 +6022,18 @@ function dbDriver(opt = {}) {
                       const obj = {};
                       try {
                         const parsed = JSON.parse(el.data);
-                        if (_optionalChain([sql, 'access', _690 => _690.field, 'optionalAccess', _691 => _691.length])) {
+                        if (_optionalChain([sql, 'access', _709 => _709.field, 'optionalAccess', _710 => _710.length])) {
                           sql.field.forEach((f) => {
                             obj[f] = _nullishCoalesce(parsed[f], () => ( ""));
                           });
                         } else {
                           Object.assign(obj, parsed);
                         }
-                      } catch (e50) {
+                      } catch (e54) {
                       }
                       return obj;
                     });
-                    if (_optionalChain([sql, 'access', _692 => _692.order, 'optionalAccess', _693 => _693.length])) {
+                    if (_optionalChain([sql, 'access', _711 => _711.order, 'optionalAccess', _712 => _712.length])) {
                       const orderField = sql.order[0];
                       const orderFieldName = typeof orderField === "string" ? orderField : orderField[0];
                       const direction = typeof orderField === "string" ? "ASC" : String(orderField[1]).toUpperCase();
@@ -5975,7 +6054,7 @@ function dbDriver(opt = {}) {
                   }
                 }
               } else {
-                result = _optionalChain([sql, 'optionalAccess', _694 => _694.list]) ? { open: [], delete: [] } : [];
+                result = _optionalChain([sql, 'optionalAccess', _713 => _713.list]) ? { open: [], delete: [] } : [];
               }
             }
           }
@@ -6031,7 +6110,7 @@ function sysserver($asai, opt = {}) {
   if (!$asai.$lib) $asai.$lib = {};
   $asai.$lib = { ...lib_default, ...$asai.$lib, ...opt || {} };
   $asai.dataserver = db_default;
-  _optionalChain([$asai, 'access', _695 => _695.$lib, 'access', _696 => _696.ErrorCode, 'optionalAccess', _697 => _697.loadErrorCodes, 'optionalCall', _698 => _698($asai)]);
+  _optionalChain([$asai, 'access', _714 => _714.$lib, 'access', _715 => _715.ErrorCode, 'optionalAccess', _716 => _716.loadErrorCodes, 'optionalCall', _717 => _717($asai)]);
   if (!$asai.$lib.api) $asai.$lib.api = {};
   $asai.$lib.api = { ...api_default, ...$asai.$lib.api };
   if (!$asai.$lib.ws) $asai.$lib.ws = {};
@@ -6224,7 +6303,7 @@ function normalizeDataStoresConfig(cfg) {
     }
     if (userStore.opt.create == null) userStore.opt.create = 1;
   }
-  if (!stores.log && _optionalChain([cfg, 'access', _699 => _699.logger, 'optionalAccess', _700 => _700.store])) {
+  if (!stores.log && _optionalChain([cfg, 'access', _718 => _718.logger, 'optionalAccess', _719 => _719.store])) {
     const s = cfg.logger.store;
     stores.log = {
       type: s.type || "file",
@@ -6288,13 +6367,13 @@ function validateHostConfig(cfg) {
   if (cfg.asaisn != null) {
     errors.push("asaisn \u7981\u6B62\u5199\u5165 asaihost.json\uFF0C\u8BF7\u4F7F\u7528 ASAI_ASAISN");
   }
-  if (_optionalChain([cfg, 'access', _701 => _701.aes, 'optionalAccess', _702 => _702.keybase64]) != null) {
+  if (_optionalChain([cfg, 'access', _720 => _720.aes, 'optionalAccess', _721 => _721.keybase64]) != null) {
     errors.push("aes.keybase64 \u7981\u6B62\u5199\u5165 asaihost.json\uFF0C\u8BF7\u4F7F\u7528 ASAI_AES_KEYBASE64");
   }
-  if (_optionalChain([cfg, 'access', _703 => _703.httpscert, 'optionalAccess', _704 => _704.key]) != null || _optionalChain([cfg, 'access', _705 => _705.httpscert, 'optionalAccess', _706 => _706.cert]) != null) {
+  if (_optionalChain([cfg, 'access', _722 => _722.httpscert, 'optionalAccess', _723 => _723.key]) != null || _optionalChain([cfg, 'access', _724 => _724.httpscert, 'optionalAccess', _725 => _725.cert]) != null) {
     errors.push("httpscert.key/cert \u7981\u6B62\u5185\u8054\u4E8E asaihost.json\uFF0C\u8BF7\u4F7F\u7528 keyPath/certPath \u6216\u73AF\u5883\u53D8\u91CF");
   }
-  if (_optionalChain([cfg, 'access', _707 => _707.security, 'optionalAccess', _708 => _708.sessionSecret]) != null) {
+  if (_optionalChain([cfg, 'access', _726 => _726.security, 'optionalAccess', _727 => _727.sessionSecret]) != null) {
     errors.push("security.sessionSecret \u7981\u6B62\u5199\u5165 asaihost.json\uFF0C\u8BF7\u4F7F\u7528 ASAI_SESSION_SECRET");
   }
   if (Array.isArray(cfg.wssec) && typeof cfg.wssec[0] === "string" && cfg.wssec[0].length > 0) {
@@ -6349,10 +6428,10 @@ function validateHostConfig(cfg) {
       validateHostSiteLimits(name, h, errors);
     }
   }
-  if (_optionalChain([cfg, 'access', _709 => _709.logger, 'optionalAccess', _710 => _710.sample]) && typeof cfg.logger.sample !== "object") {
+  if (_optionalChain([cfg, 'access', _728 => _728.logger, 'optionalAccess', _729 => _729.sample]) && typeof cfg.logger.sample !== "object") {
     errors.push('logger.sample \u5FC5\u987B\u4E3A\u5BF9\u8C61\uFF08\u5982 { "REQ_OTHER": 0.1 }\uFF09');
   }
-  if (_optionalChain([cfg, 'access', _711 => _711.logger, 'optionalAccess', _712 => _712.skip]) != null && !Array.isArray(cfg.logger.skip)) {
+  if (_optionalChain([cfg, 'access', _730 => _730.logger, 'optionalAccess', _731 => _731.skip]) != null && !Array.isArray(cfg.logger.skip)) {
     errors.push('logger.skip \u5FC5\u987B\u4E3A\u5B57\u7B26\u4E32\u6570\u7EC4\uFF08\u5982 ["/sys/info/metrics"]\uFF09');
   }
   if (cfg.proxyhosts && typeof cfg.proxyhosts === "object") {
@@ -6386,7 +6465,7 @@ _chunkSMVZ3ZDJcjs.__name.call(void 0, validateHostSiteLimits, "validateHostSiteL
 function validateProductionSecurity(cfg) {
   const errors = [];
   if (process.env.NODE_ENV !== "production") return errors;
-  const sec = _optionalChain([cfg, 'optionalAccess', _713 => _713.security]);
+  const sec = _optionalChain([cfg, 'optionalAccess', _732 => _732.security]);
   if (!sec || typeof sec !== "object") {
     errors.push("\u751F\u4EA7\u73AF\u5883\u5FC5\u987B\u914D\u7F6E security \u5BF9\u8C61");
     return errors;
@@ -6397,7 +6476,7 @@ function validateProductionSecurity(cfg) {
   if (sec.allowRegister === 1) {
     errors.push("\u751F\u4EA7\u73AF\u5883 security.allowRegister \u5E94\u4E3A 0\uFF08CR 1.3 \u7981\u6B62\u5F00\u653E\u6CE8\u518C\uFF09");
   }
-  if (!_optionalChain([sec, 'access', _714 => _714.quota, 'optionalAccess', _715 => _715.enabled])) {
+  if (!_optionalChain([sec, 'access', _733 => _733.quota, 'optionalAccess', _734 => _734.enabled])) {
     errors.push("\u751F\u4EA7\u73AF\u5883 security.quota.enabled \u5E94\u4E3A 1\uFF08CR 7.1 \u8D44\u6E90\u9650\u5236\uFF09");
   }
   if (sec.csp !== 1) {
@@ -6406,7 +6485,7 @@ function validateProductionSecurity(cfg) {
   if (typeof sec.minUserLevel !== "number" || sec.minUserLevel < 0) {
     errors.push("\u751F\u4EA7\u73AF\u5883 security.minUserLevel \u5E94\u663E\u5F0F\u914D\u7F6E");
   }
-  if (sec.forceWss === 1 && !_optionalChain([cfg, 'optionalAccess', _716 => _716.httpscert, 'optionalAccess', _717 => _717.keyPath]) && !_optionalChain([cfg, 'optionalAccess', _718 => _718.httpscert, 'optionalAccess', _719 => _719.key])) {
+  if (sec.forceWss === 1 && !_optionalChain([cfg, 'optionalAccess', _735 => _735.httpscert, 'optionalAccess', _736 => _736.keyPath]) && !_optionalChain([cfg, 'optionalAccess', _737 => _737.httpscert, 'optionalAccess', _738 => _738.key])) {
     errors.push("\u751F\u4EA7\u73AF\u5883 security.forceWss=1 \u65F6\u9700\u914D\u7F6E HTTPS \u8BC1\u4E66");
   }
   return errors;
@@ -6425,12 +6504,12 @@ var DEFAULT_RECONNECT = {
   rs485: { enabled: true, maxRetries: 60, initialDelay: 3e3, maxDelay: 3e4, factor: 2 }
 };
 function getTransportBlock(cfg, kind) {
-  const block = _optionalChain([cfg, 'optionalAccess', _720 => _720[kind]]);
+  const block = _optionalChain([cfg, 'optionalAccess', _739 => _739[kind]]);
   return block && typeof block === "object" ? block : null;
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, getTransportBlock, "getTransportBlock");
 function getTransportDefault(cfg, kind) {
-  const def = _optionalChain([getTransportBlock, 'call', _721 => _721(cfg, kind), 'optionalAccess', _722 => _722.default]);
+  const def = _optionalChain([getTransportBlock, 'call', _740 => _740(cfg, kind), 'optionalAccess', _741 => _741.default]);
   return def && typeof def === "object" ? def : null;
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, getTransportDefault, "getTransportDefault");
@@ -6440,7 +6519,7 @@ function hasTransportDefault(cfg, kind) {
 _chunkSMVZ3ZDJcjs.__name.call(void 0, hasTransportDefault, "hasTransportDefault");
 function getDefaultConnId(cfg, kind) {
   const def = getTransportDefault(cfg, kind);
-  const id = _optionalChain([def, 'optionalAccess', _723 => _723.id]);
+  const id = _optionalChain([def, 'optionalAccess', _742 => _742.id]);
   return typeof id === "string" && id.length > 0 ? id : DEFAULT_CONN_ID[kind];
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, getDefaultConnId, "getDefaultConnId");
@@ -6451,14 +6530,14 @@ function shouldAutoConnect(def) {
 _chunkSMVZ3ZDJcjs.__name.call(void 0, shouldAutoConnect, "shouldAutoConnect");
 function resolveReconnectOptions(def, kind, cfg) {
   const base = DEFAULT_RECONNECT[kind];
-  const rc = _optionalChain([def, 'optionalAccess', _724 => _724.reconnect]);
-  const tmMaxTry = _optionalChain([cfg, 'optionalAccess', _725 => _725.tm, 'optionalAccess', _726 => _726.maxtry]);
+  const rc = _optionalChain([def, 'optionalAccess', _743 => _743.reconnect]);
+  const tmMaxTry = _optionalChain([cfg, 'optionalAccess', _744 => _744.tm, 'optionalAccess', _745 => _745.maxtry]);
   return {
-    enabled: _optionalChain([rc, 'optionalAccess', _727 => _727.enabled]) !== false && base.enabled !== false,
-    maxRetries: _nullishCoalesce(_nullishCoalesce(_nullishCoalesce(_optionalChain([rc, 'optionalAccess', _728 => _728.maxRetries]), () => ( tmMaxTry)), () => ( base.maxRetries)), () => ( 60)),
-    initialDelay: _nullishCoalesce(_nullishCoalesce(_optionalChain([rc, 'optionalAccess', _729 => _729.initialDelay]), () => ( base.initialDelay)), () => ( 1e3)),
-    maxDelay: _nullishCoalesce(_nullishCoalesce(_optionalChain([rc, 'optionalAccess', _730 => _730.maxDelay]), () => ( base.maxDelay)), () => ( 3e4)),
-    factor: _nullishCoalesce(_nullishCoalesce(_optionalChain([rc, 'optionalAccess', _731 => _731.factor]), () => ( base.factor)), () => ( 2))
+    enabled: _optionalChain([rc, 'optionalAccess', _746 => _746.enabled]) !== false && base.enabled !== false,
+    maxRetries: _nullishCoalesce(_nullishCoalesce(_nullishCoalesce(_optionalChain([rc, 'optionalAccess', _747 => _747.maxRetries]), () => ( tmMaxTry)), () => ( base.maxRetries)), () => ( 60)),
+    initialDelay: _nullishCoalesce(_nullishCoalesce(_optionalChain([rc, 'optionalAccess', _748 => _748.initialDelay]), () => ( base.initialDelay)), () => ( 1e3)),
+    maxDelay: _nullishCoalesce(_nullishCoalesce(_optionalChain([rc, 'optionalAccess', _749 => _749.maxDelay]), () => ( base.maxDelay)), () => ( 3e4)),
+    factor: _nullishCoalesce(_nullishCoalesce(_optionalChain([rc, 'optionalAccess', _750 => _750.factor]), () => ( base.factor)), () => ( 2))
   };
 }
 _chunkSMVZ3ZDJcjs.__name.call(void 0, resolveReconnectOptions, "resolveReconnectOptions");
@@ -6508,17 +6587,17 @@ function createTransportDataHandler($asai, manager) {
     if (typeof event.data === "string") {
       try {
         event.data = JSON.parse(event.data);
-      } catch (e51) {
+      } catch (e55) {
       }
     }
-    if (_optionalChain([event, 'access', _732 => _732.data, 'optionalAccess', _733 => _733.id])) {
+    if (_optionalChain([event, 'access', _751 => _751.data, 'optionalAccess', _752 => _752.id])) {
       manager.watch(event.id, event.data);
       return;
     }
     try {
-      const wsKey = _optionalChain([$asai, 'optionalAccess', _734 => _734.command, 'optionalAccess', _735 => _735.commandconfig, 'optionalAccess', _736 => _736.config, 'optionalAccess', _737 => _737.commandclient]);
-      _optionalChain([$asai, 'access', _738 => _738.serversws, 'optionalAccess', _739 => _739[wsKey], 'optionalAccess', _740 => _740.broadws, 'optionalCall', _741 => _741(event.data)]);
-    } catch (e52) {
+      const wsKey = _optionalChain([$asai, 'optionalAccess', _753 => _753.command, 'optionalAccess', _754 => _754.commandconfig, 'optionalAccess', _755 => _755.config, 'optionalAccess', _756 => _756.commandclient]);
+      _optionalChain([$asai, 'access', _757 => _757.serversws, 'optionalAccess', _758 => _758[wsKey], 'optionalAccess', _759 => _759.broadws, 'optionalCall', _760 => _760(event.data)]);
+    } catch (e56) {
     }
   };
 }
@@ -6590,7 +6669,7 @@ var initAsaiHostNodejs2 = {
   createTransportDataHandler,
   wireTransportConnectionLogs
 };
-var PLUGIN_VERSION = true ? "0.0.8" : "0.0.1";
+var PLUGIN_VERSION = true ? "0.0.9" : "0.0.1";
 var index_default = initAsaiHostNodejs2;