w-web-api 1.0.53 → 1.0.56

package/logs/2026-07-11T17.log

@@ -0,0 +1,2 @@
+{"level":30,"time":1783763274489,"pid":20076,"hostname":"semi-win-dev3","event":"verifyClientUser","from":"getUserByToken","userId":"id-for-admin"}
+{"level":30,"time":1783763274490,"pid":20076,"hostname":"semi-win-dev3","event":"api/getUserByToken","userId":"id-for-admin"}

package/package.json

@@ -1,19 +1,19 @@
 {
   "name": "w-web-api",
-  "version": "1.0.53",
+  "version": "1.0.56",
   "main": "dist/w-web-api.umd.js",
   "dependencies": {
     "@mdi/js": "^7.4.47",
-    "axios": "^1.18.0",
+    "axios": "^1.18.1",
     "lodash-es": "^4.18.1",
     "showdown": "^2.1.0",
-    "w-component-vue": "^2.4.66",
-    "w-data-collector": "^1.0.22",
-    "w-serv-hapi": "^1.0.72",
-    "w-serv-orm": "^1.0.38",
-    "w-ui-loginout": "^1.0.10",
-    "w-syslog": "^1.0.8",
-    "wsemi": "^1.8.61"
+    "w-component-vue": "^2.4.74",
+    "w-data-collector": "^1.0.23",
+    "w-serv-hapi": "^1.0.74",
+    "w-serv-orm": "^1.0.40",
+    "w-ui-loginout": "^1.0.11",
+    "w-syslog": "^1.0.10",
+    "wsemi": "^1.8.66"
   },
   "devDependencies": {
     "@vue/cli-plugin-babel": "^5.0.8",
@@ -27,18 +27,19 @@
     "eslint-plugin-promise": "^6.1.1",
     "eslint-plugin-vue": "^9.10.0",
     "pixelmatch": "^7.2.0",
-    "playwright": "^1.61.0",
+    "playwright": "^1.61.1",
     "pngjs": "^7.0.0",
     "vue": "^2.6.14",
     "vuex": "^3.6.2",
-    "w-orm-lmdb": "^1.0.6",
-    "w-screenctl": "^1.0.3",
-    "w-package-tools": "^1.1.9"
+    "w-orm-lmdb": "^1.0.8",
+    "w-screenctl": "^1.0.4",
+    "w-package-tools": "^1.1.11"
   },
   "scripts": {
     "serve": "vue-cli-service serve",
     "build": "vue-cli-service build",
-    "test": "mocha --timeout 300000",
+    "test:unit": "node server/staLogs/test_staEvent.mjs",
+    "test": "node server/staLogs/test_staEvent.mjs && mocha --timeout 300000",
     "lint": "vue-cli-service lint",
     "deploy": "gh-pages -d docs"
   },

package/server/WWebApi.mjs

@@ -230,7 +230,7 @@ function WWebApi(WOrm, url, db, getUserByToken, verifyClientUser, verifyAppUser,
     //params
     let showLanguage = get(opt, 'showLanguage', 'y')
     let language = get(opt, 'language', 'eng')
-    let logFd = get(opt, 'logFd', './_logs') //srLog 寫入 + staEvent 統計共用之 log 資料夾
+    let logFd = get(opt, 'logFd', './logs') //srLog 寫入 + staEvent 統計共用之 log 資料夾
 
 
     //kpLangExt
@@ -252,7 +252,9 @@ function WWebApi(WOrm, url, db, getUserByToken, verifyClientUser, verifyAppUser,
         wp = WServOrm(ds, WOrm, url, db, optWServOrm)
     }
     catch (err) {
-        console.log(err)
+        //ORM 為必要依賴：初始化失敗即 fail-fast，不以 wp={} 帶 undefined woItems/procOrm 殘缺啟動（與建構子其餘必要依賴一致）
+        console.log('WServOrm init failed', err)
+        throw err
     }
     let { woItems, procOrm } = wp
 
@@ -260,6 +262,9 @@ function WWebApi(WOrm, url, db, getUserByToken, verifyClientUser, verifyAppUser,
     //srLog（後端 log；錯誤一律 log err-key 供識別，對齊 w-web-sso）
     let srLog = srLogInit(opt)
 
+    //maskTok：debug console.log 不印完整 token/authorization（憑證），僅前 4 碼 + ***，避免憑證落入 stdout
+    let maskTok = (t) => isestr(t) ? (strleft(t, 4) + '***') : t
+
     //kpFunExt 邊界統一處理：成功記 info（供 staEvent 統計呼叫頻率）；catch 後端錯誤 → srLog 該 err-key →
     //原樣 re-reject（前端依 key 查自己 lang 顯示）。event 統一加 'kpfun-' 前綴 → 專用事件、與 api/verifyConn 區分。
     let wrapErrLog = (event, fn) => {
@@ -343,14 +348,7 @@ function WWebApi(WOrm, url, db, getUserByToken, verifyClientUser, verifyAppUser,
         }
 
         //check
-        if (true) {
-            // if (!iseobj(userSelf)) {
-            //     console.log(`token`, token)
-            //     console.log(`can not find the user from token`)
-            //     return Promise.reject('errUserNotFound')
-            // }
-            await checkUser(userSelf)
-        }
+        await checkUser(userSelf)
 
         return userSelf
     }
@@ -626,9 +624,8 @@ function WWebApi(WOrm, url, db, getUserByToken, verifyClientUser, verifyAppUser,
                     //check
                     if (!isestr(token)) {
                         console.log('req.query', get(req, 'query'))
-                        console.log('token', token)
+                        console.log('token', maskTok(token))
                         console.log('[API]getUserByToken/check token: invalid token')
-                        console.log(`token does not have permission`)
                         return Promise.reject('errTokenNoPermission')
                     }
 
@@ -637,9 +634,8 @@ function WWebApi(WOrm, url, db, getUserByToken, verifyClientUser, verifyAppUser,
 
                     //check
                     if (!iseobj(user)) {
-                        console.log('token', token)
+                        console.log('token', maskTok(token))
                         console.log('[API]getUserByToken/check user: invalid user')
-                        console.log(`token does not have permission`)
                         return Promise.reject('errTokenNoPermission')
                     }
 
@@ -674,7 +670,6 @@ function WWebApi(WOrm, url, db, getUserByToken, verifyClientUser, verifyAppUser,
         //                 console.log('req.query', get(req, 'query'))
         //                 console.log('token', token)
         //                 console.log('[API]getAPIsList/check token: invalid token')
-        //                 console.log(`token does not have permission`)
         //                 return Promise.reject('errTokenNoPermission')
         //             }
 
@@ -685,7 +680,6 @@ function WWebApi(WOrm, url, db, getUserByToken, verifyClientUser, verifyAppUser,
         //             if (!iseobj(user)) {
         //                 console.log('token', token)
         //                 console.log('[API]getAPIsList/check user: invalid user')
-        //                 console.log(`token does not have permission`)
         //                 return Promise.reject('errTokenNoPermission')
         //             }
 
@@ -723,7 +717,6 @@ function WWebApi(WOrm, url, db, getUserByToken, verifyClientUser, verifyAppUser,
         //                 console.log('req.query', get(req, 'query'))
         //                 console.log('token', token)
         //                 console.log('[API]updateAPIs/check token: invalid token')
-        //                 console.log(`token does not have permission`)
         //                 return Promise.reject('errTokenNoPermission')
         //             }
 
@@ -734,7 +727,6 @@ function WWebApi(WOrm, url, db, getUserByToken, verifyClientUser, verifyAppUser,
         //             if (!iseobj(user)) {
         //                 console.log('token', token)
         //                 console.log('[API]updateAPIs/check user: invalid user')
-        //                 console.log(`token does not have permission`)
         //                 return Promise.reject('errTokenNoPermission')
         //             }
 
@@ -773,9 +765,8 @@ function WWebApi(WOrm, url, db, getUserByToken, verifyClientUser, verifyAppUser,
                     //check
                     if (!isestr(token)) {
                         console.log('req.query', get(req, 'query'))
-                        console.log('token', token)
+                        console.log('token', maskTok(token))
                         console.log('[API]syncAndReplaceTabs/check token: invalid token')
-                        console.log(`token does not have permission`)
                         return Promise.reject('errTokenNoPermission')
                     }
 
@@ -787,8 +778,7 @@ function WWebApi(WOrm, url, db, getUserByToken, verifyClientUser, verifyAppUser,
                         console.log('req.query', get(req, 'query'))
                         console.log('keyTable', keyTable)
                         console.log('[API]syncAndReplaceTabs/check keyTable: invalid keyTable')
-                        console.log(`token does not have permission`)
-                        return Promise.reject('errTokenNoPermission')
+                        return Promise.reject('errKeyTableInvalid')
                     }
 
                     //check keyTable
@@ -803,9 +793,8 @@ function WWebApi(WOrm, url, db, getUserByToken, verifyClientUser, verifyAppUser,
 
                     //check
                     if (!iseobj(user)) {
-                        console.log('token', token)
+                        console.log('token', maskTok(token))
                         console.log('[API]syncAndReplaceTabs/check user: invalid user')
-                        console.log(`token does not have permission`)
                         return Promise.reject('errTokenNoPermission')
                     }
 
@@ -814,10 +803,9 @@ function WWebApi(WOrm, url, db, getUserByToken, verifyClientUser, verifyAppUser,
 
                     //check userId
                     if (!isestr(userId)) {
-                        console.log('token', token)
+                        console.log('token', maskTok(token))
                         console.log('user', user)
                         console.log('[API]syncAndReplaceTabs/check userId: invalid userId')
-                        console.log(`token does not have permission`)
                         return Promise.reject('errTokenNoPermission')
                     }
 
@@ -855,7 +843,7 @@ function WWebApi(WOrm, url, db, getUserByToken, verifyClientUser, verifyAppUser,
 
     //WServHapiServer
     instWServHapiServer = new WServHapiServer({
-        port: opt.serverPort,
+        port: serverPort,
         pathStaticFiles,
         apiName: 'api',
         apis,
@@ -870,16 +858,18 @@ function WWebApi(WOrm, url, db, getUserByToken, verifyClientUser, verifyAppUser,
             //check
             if (!isestr(token)) {
                 console.log('apiType', apiType)
-                console.log('authorization', authorization)
+                console.log('authorization', maskTok(authorization))
                 console.log('invalid token')
                 return false
             }
 
-            //checkToken
+            //checkToken：套件層連線閘僅做「token 認證」（解析 user + 驗欄位齊備）。**授權**（如限管理員）屬
+            //套件使用者之責——由其提供之 getUserByToken（可對非授權者回 {}）/ verifyClientUser / verifyAppUser，
+            //或 WServOrm 之 useCheckUser/useExcludeWhenNotAdmin 等鉤子決定；套件不對連線層強加特定授權政策（避免越界、
+            //保留使用者彈性）。詳見 spec/設計要點與取捨.md「套件授權責任」。
             let b = await p.checkToken(token)
-            // console.log('b', b)
 
-            srLog.info({ event: 'verifyConn', apiType }) //連線驗證通過（checkToken 失敗時會 throw 不到此）
+            srLog.info({ event: 'verifyConn', apiType }) //連線之 token 認證通過（checkToken 失敗會 throw 不到此）
             return b
         },
         getUserIdByToken: async (token) => { //可使用async或sync函數
@@ -915,8 +905,8 @@ function WWebApi(WOrm, url, db, getUserByToken, verifyClientUser, verifyAppUser,
                 return deleteApi(userId, id)
             }),
 
-            //統計資訊頁：回傳各 event 之時段發生頻率（讀 logFd 之 log）。連線已由 verifyClientUser 限管理員，
-            //故此處不另檢查（同 getApisList）。timeLength 天數 / timeInterval 'hr'|'day'。
+            //統計資訊頁：回傳各 event 之時段發生頻率（讀 logFd 之 log）。連線之 token 認證由 verifyConn 把關；
+            //授權（限管理員）屬套件使用者責任（見 verifyConn 註解與設計要點與取捨「套件授權責任」）。timeLength 天數 / timeInterval 'hr'|'day'。
             getStaEvent: wrapErrLog('getStaEvent', (userId, timeLength = 7, timeInterval = 'hr') => {
                 return staEvent(timeLength, timeInterval, { fdLog: logFd })
             }),

package/server/procLang.mjs

@@ -26,10 +26,6 @@ let kpLang = {
         cht: '拒絕登入',
     },
 
-    aggridLanguage: {
-        eng: 'en',
-        cht: 'zh-tw',
-    },
 
     systemMessage: {
         eng: 'System message',
@@ -57,22 +53,10 @@ let kpLang = {
         cht: '等待數據中...',
     },
 
-    isEditabled: {
-        eng: 'Editable',
-        cht: '是否編輯',
-    },
-    saveChanges: {
-        eng: `Save changes`,
-        cht: `儲存變更`,
-    },
     id: {
         eng: `Id`,
         cht: `主鍵`,
     },
-    from: {
-        eng: `From`,
-        cht: `來源`,
-    },
     save: {
         eng: `Save`,
         cht: `儲存`,
@@ -89,38 +73,6 @@ let kpLang = {
         eng: `Cancel`,
         cht: `取消`,
     },
-    screenFull: {
-        eng: `Max size`,
-        cht: `最大化尺寸`,
-    },
-    screenNormal: {
-        eng: `Normal size`,
-        cht: `預設尺寸`,
-    },
-    checkAllYes: {
-        eng: `Check all`,
-        cht: `全選使用`,
-    },
-    checkAllNo: {
-        eng: `Uncheck all`,
-        cht: `全不選使用`,
-    },
-    checkAllInv: {
-        eng: `Reverse all`,
-        cht: `全反選使用`,
-    },
-    operMode: {
-        eng: `Enable`,
-        cht: `是否使用`,
-    },
-    operPemiEnable: {
-        eng: `Operator`,
-        cht: `合併權限模式`,
-    },
-    operGrupEnable: {
-        eng: `Operator`,
-        cht: `合併權限群組模式`,
-    },
 
     processing: {
         eng: `Processing...`,
@@ -130,10 +82,6 @@ let kpLang = {
         eng: `An unexpected error occurred, please contact the administrator`,
         cht: `發生非預期錯誤，請洽管理員`,
     },
-    unknow: {
-        eng: `Unknow`,
-        cht: `未知`,
-    },
 
     username: {
         eng: `Username`,
@@ -155,14 +103,6 @@ let kpLang = {
     //     eng: `No description`,
     //     cht: `無說明`,
     // },
-    modeEdit: {
-        eng: `Edit mode`,
-        cht: `編輯模式`,
-    },
-    showTabCols: {
-        eng: `Show columns`,
-        cht: `顯示欄位`,
-    },
 
     menuTreeShow: {
         eng: 'Show API list',
@@ -238,14 +178,6 @@ let kpLang = {
         cht: '回傳數據範例',
     },
 
-    outputMenuTree: {
-        eng: 'Tree',
-        cht: '樹狀組件',
-    },
-    outputMenuRaw: {
-        eng: 'Raw',
-        cht: '原始數據',
-    },
 
     //--- API 管理（展示/編輯/測試）---
 
@@ -294,14 +226,6 @@ let kpLang = {
         eng: 'Frequency of backend logged events (APIs, kpFunExt, connection verification).',
         cht: '後端各事件（API、kpFunExt、連線驗證）之發生頻率統計。',
     },
-    eventFrequency: {
-        eng: 'Event Frequency',
-        cht: '事件發生頻率',
-    },
-    showIndividually: {
-        eng: 'Show individually',
-        cht: '個別顯示',
-    },
     selectEvents: {
         eng: 'Select events',
         cht: '選擇事件',
@@ -338,10 +262,6 @@ let kpLang = {
         eng: 'Last 1 hr',
         cht: '最近1時',
     },
-    countTotal: {
-        eng: 'Total',
-        cht: '總次數',
-    },
     timeRange: {
         eng: 'Time range',
         cht: '時間範圍',
@@ -371,14 +291,18 @@ let kpLang = {
         cht: '取得資料失敗',
     },
 
+    //保留供日後擴充之 UI 標籤鍵（目前無 $t 引用，先以註解保留；需用時取消註解並於對應元件加 $t）。
+    //eventFrequency/countTotal/showIndividually 為統計頁可能擴充之標籤；editApiTitle/resStatus 值為依用途重建之起始值，啟用時請確認。
+    // eventFrequency: { eng: 'Event Frequency', cht: '事件發生頻率' },
+    // countTotal: { eng: 'Total', cht: '總次數' },
+    // showIndividually: { eng: 'Show individually', cht: '個別顯示' },
+    // editApiTitle: { eng: 'Edit API', cht: '編輯API' },
+    // resStatus: { eng: 'Status', cht: '狀態碼' },
+
     addApi: {
         eng: 'New API',
         cht: '新增API',
     },
-    editApiTitle: {
-        eng: 'Edit API',
-        cht: '編輯API',
-    },
     confirmDeleteApi: {
         eng: 'Are you sure you want to delete this API?',
         cht: '確定要刪除此API？',
@@ -537,10 +461,6 @@ let kpLang = {
         eng: 'Response',
         cht: '回應',
     },
-    resStatus: {
-        eng: 'Status',
-        cht: '狀態碼',
-    },
     resTime: {
         eng: 'Time',
         cht: '耗時',

package/server/procProxy.mjs

@@ -13,101 +13,101 @@ function procProxy(opt = {}) {
     let isAllowTarget = get(opt, 'isAllowTarget', null)
 
 
-    let proxyRequest = (inp = {}) => {
-        return new Promise(async (resolve, reject) => {
-
-            //method
-            let method = get(inp, 'method', 'GET')
-            if (!isestr(method)) {
-                method = 'GET'
-            }
-            method = method.toUpperCase()
-
-            //url
-            let url = get(inp, 'url', '')
-            if (!isestr(url)) {
-                reject('errReqUrlInvalid')
-                return
-            }
-            if (!url.startsWith('http://') && !url.startsWith('https://')) {
-                reject('errReqUrlInvalid')
-                return
-            }
-
-            //isAllowTarget check
-            if (typeof isAllowTarget === 'function') {
-                let allowed = isAllowTarget(url)
-                if (allowed === false) {
-                    reject('errReqTargetNotAllowed')
-                    return
-                }
+    let proxyRequest = async (inp = {}) => {
+
+        //method
+        let method = get(inp, 'method', 'GET')
+        if (!isestr(method)) {
+            method = 'GET'
+        }
+        method = method.toUpperCase()
+
+        //url
+        let url = get(inp, 'url', '')
+        if (!isestr(url)) {
+            return Promise.reject('errReqUrlInvalid')
+        }
+        if (!url.startsWith('http://') && !url.startsWith('https://')) {
+            return Promise.reject('errReqUrlInvalid')
+        }
+
+        //isAllowTarget check
+        if (typeof isAllowTarget === 'function') {
+            let allowed = isAllowTarget(url)
+            if (allowed === false) {
+                return Promise.reject('errReqTargetNotAllowed')
             }
-
-            //headers
-            let headers = get(inp, 'headers', {})
-            if (!isobj(headers)) {
-                headers = {}
-            }
-            //移除 host 與 content-length (交給 axios)
-            delete headers['host']
-            delete headers['Host']
-            delete headers['content-length']
-            delete headers['Content-Length']
-
-            //query
-            let query = get(inp, 'query', null)
-            let params = null
-            if (isobj(query) && Object.keys(query).length > 0) {
-                params = query
-            }
-
-            //body
-            let body = get(inp, 'body', undefined)
-            let data = undefined
-            if (method !== 'GET' && method !== 'HEAD') {
-                if (body !== undefined) {
-                    data = body
-                }
+        }
+
+        //headers
+        let headers = get(inp, 'headers', {})
+        if (!isobj(headers)) {
+            headers = {}
+        }
+
+        //移除 host 與 content-length (交給 axios)
+        delete headers['host']
+        delete headers['Host']
+        delete headers['content-length']
+        delete headers['Content-Length']
+
+        //query
+        let query = get(inp, 'query', null)
+        let params = null
+        if (isobj(query) && Object.keys(query).length > 0) {
+            params = query
+        }
+
+        //body
+        let body = get(inp, 'body', undefined)
+        let data = undefined
+        if (method !== 'GET' && method !== 'HEAD') {
+            if (body !== undefined) {
+                data = body
             }
-
-            //timeout
-            let timeout = get(inp, 'timeout', 30000)
-            if (typeof timeout !== 'number' || timeout <= 0) {
-                timeout = 30000
+        }
+
+        //timeout
+        let timeout = get(inp, 'timeout', 30000)
+        if (typeof timeout !== 'number' || timeout <= 0) {
+            timeout = 30000
+        }
+
+        //send
+        let r
+        let t0 = Date.now()
+        try {
+            let res = await axios({
+                method,
+                url,
+                headers,
+                params,
+                data,
+                timeout,
+                validateStatus: () => true,
+            })
+
+            let durationMs = Date.now() - t0
+
+            //r
+            r = {
+                status: res.status,
+                statusText: res.statusText,
+                headers: res.headers,
+                data: res.data,
+                durationMs,
             }
 
-            //send
-            let t0 = Date.now()
-            try {
-                let res = await axios({
-                    method,
-                    url,
-                    headers,
-                    params,
-                    data,
-                    timeout,
-                    validateStatus: () => true,
-                })
-
-                let durationMs = Date.now() - t0
-
-                resolve({
-                    status: res.status,
-                    statusText: res.statusText,
-                    headers: res.headers,
-                    data: res.data,
-                    durationMs,
-                })
-            }
-            catch (err) {
-                //axios 例外（timeout/DNS 等）：log 真實訊息供排查，但回前端只給 err-key（前端依 lang 顯示）
-                if (srLog) {
-                    srLog.error({ event: 'proxyRequest-axios', msg: get(err, 'message', String(err)) })
-                }
-                reject('errProxyRequestFailed')
+        }
+        catch (err) {
+            //axios 例外（timeout/DNS 等）：log 真實訊息供排查，但回前端只給 err-key（前端依 lang 顯示）
+            if (srLog) {
+                srLog.error({ event: 'proxyRequest-axios', msg: get(err, 'message', String(err)) })
             }
+            return Promise.reject('errProxyRequestFailed')
+        }
 
-        })
+        return r
     }
 
 

package/server/srLog.mjs

@@ -3,14 +3,14 @@ import isestr from 'wsemi/src/isestr.mjs'
 import WSyslog from 'w-syslog/src/WSyslog.mjs'
 
 
-//後端 log（比照 w-web-sso server/srLog.mjs）：包 w-syslog，依時段輪檔寫入 ./_logs。
+//後端 log（比照 w-web-sso server/srLog.mjs）：包 w-syslog，依時段輪檔寫入 ./logs。
 //用法：srLog.info({ event, ... }) / srLog.warn({...}) / srLog.error({ event, err, ... })。
 //錯誤一律 log 其 err key（對齊「後端錯誤須 log err key」原則），供事後識別。
 let init = (opt = {}) => {
 
     let fdLog = get(opt, 'logFd', '')
     if (!isestr(fdLog)) {
-        fdLog = './_logs'
+        fdLog = './logs'
     }
 
     let interval = get(opt, 'logInterval', '')

package/server/staLogs/filterVpfsByWindow.mjs

@@ -0,0 +1,27 @@
+import get from 'lodash-es/get.js'
+import filter from 'lodash-es/filter.js'
+
+
+//filterVpfsByWindow: 開檔前依「檔名時間窗」過濾 log 檔清單, 剔除窗外檔.
+//w-syslog 檔名為 ISO 前綴 (hr: `YYYY-MM-DDTHH.log` / day: `YYYY-MM-DD.log`), 字典序 ≡ 時間序,
+//故可用字串比較篩選 (w-syslog 自身 cleanLogs 亦依賴此性質, 見 node_modules/w-syslog/src/WSyslog.mjs:127-128).
+//邊界檔一律保留, 其內 per-line `t.isAfter(tStart)` 仍為最終判準 → 輸出語意零改變.
+//fail-open: 檔名不符 ISO 前綴者一律保留 (寧可多讀, 不可漏讀).
+//vpfs 為 fsTreeFolder 回傳之物件陣列, 每筆含 { path, name, isFolder, level }.
+//【粒度自適應】比較時以「檔名長度」截取 keyStart: srLog 之 logInterval (決定檔名粒度) 與 staLogs 之
+//timeInterval (決定 fmt) 為兩個獨立設定, 兩者不一定相同. 若檔名為 day 粒度 (10 字元) 而 fmt 為 hr 粒度
+//(13 字元), 直接比較會把「當天檔」誤判為窗外 (`'2026-07-08' < '2026-07-08T21'`) → 漏讀整天資料.
+//截取後 day 檔以日期比日期、hr 檔以小時比小時, 兩種粒度皆正確且一律偏保留 (fail-safe).
+function filterVpfsByWindow(vpfs, tStart, fmt) {
+    let keyStart = tStart.format(fmt)
+    return filter(vpfs, (vpf) => {
+        let bn = get(vpf, 'name', '').replace(/\.log$/, '')
+        if (!/^\d{4}-\d{2}-\d{2}/.test(bn)) {
+            return true //fail-open: 非預期檔名一律保留
+        }
+        return bn >= keyStart.slice(0, bn.length)
+    })
+}
+
+
+export default filterVpfsByWindow