diff --git a/readme.md b/readme.md
index 12c87d5..2968b95 100644
--- a/readme.md
+++ b/readme.md
@@ -27,7 +27,7 @@
 		- `que.ts` 查询接口 `query` `HTTP GET` 对数据组合做请求
 		- `pas.ts` 用户登陆 `pass` (的操作组合)
 		- `pre.ts` 创建操作 `pre-data` `prepare` （的操作组合）
-		- `put.ts` 数据操作 `put-data`（的操作组合）
+		- `put.ts` 更新操作 `put-data`（的操作组合）
 		- `pos.ts` 请求接口 `post` `HTTP POST` 对操作组合做请求
 	* `ser.ts` 服务接口 `serve`
 * `tst` 测试代码 `tests`
diff --git a/src/pra/pos.ts b/src/pra/pos.ts
index 88d7859..e7df4d7 100644
--- a/src/pra/pos.ts
+++ b/src/pra/pos.ts
@@ -7,23 +7,24 @@ export type { PreRet } from "./pre.ts"
 
 export type Pos = Psg | Pre
 export type PosRet = {
-	psg: Ret<typeof psg>,
-	pre: { ret: Ret<typeof pre> },
+	ret: Ret<typeof psg>["ret"] | Ret<typeof pre>,
+	jwt?: string | null,
+	etag?: "",
 }
 
 export async function pos(
 	b: string,
 	jwt?: string,
-) {
+): Promise<PosRet> {
 	let json
 	try { json = b.length > 0 ? JSON.parse(b) as Pos : {} }
 	catch { return { ret: null } }
 
 	const p = jwt ? await pas(jwt) : null
-
+	let ret = null
 	if ("psg" in json) return psg(p, json)
-	else if (!p) return { ret: null }
-	else if ("pre" in json) return { ret: await pre(p, json) }
+	else if (!p) return { ret: null, jwt: null }
+	else if ("pre" in json) ret = await pre(p, json)
 
-	return { ret: null }
+	return ret ? { ret, etag: "" } : { ret }
 }
diff --git a/src/ser.ts b/src/ser.ts
index 930bde0..15aa9de 100644
--- a/src/ser.ts
+++ b/src/ser.ts
@@ -1,5 +1,6 @@
 import { db } from "./eid/db.ts"
 import { utc_dt, utc_etag, utc_h } from "./ont/utc.ts"
+import { pos } from "./pra/pos.ts"
 import { que } from "./pra/que.ts"
 
 db("ismism")
@@ -40,6 +41,20 @@ async function handler(
 			log(utc, `${r}${s}`, 200)
 			const q = await que(s)
 			return new Response(JSON.stringify(q), { status: 200, headers: { etag } })
+		} case "p": {
+			const [cookie] = req.headers.get("cookie")?.split(";").filter(c => c.startsWith("pp=")) ?? []
+			const jwt = cookie ? cookie.substring(3) : undefined
+			const b = await req.text()
+			const r = await pos(b, jwt)
+			const headers: Headers = new Headers()
+			if ("jwt" in r) {
+				const [pp, ma] = r.jwt ? [r.jwt, 31728728] : ["", 0]
+				headers.set("set-cookie", `pp=${pp}; Path=/p; SameSite=Strict; Secure; HttpOnly; Max-Age=${ma}`)
+			}
+			if ("etag" in r) etag = r.etag ?? ""
+			const s = JSON.stringify(r.ret)
+			log(utc, `${b} => ${s}`, 200)
+			return new Response(s, { status: 200, headers })
 		}
 	}
 	return new Response(null, { status: 400 })
diff --git a/tst/pos.test.ts b/tst/pos.test.ts
index fb47e64..c7a2fe4 100644
--- a/tst/pos.test.ts
+++ b/tst/pos.test.ts
@@ -19,7 +19,7 @@ Deno.test("pas", async () => {
 	const usr = await usr_c(nbr, "四川", "成都")
 	assertEquals(1, usr)
 	assertEquals([
-		{ ret: null }, { ret: null }, { ret: null }
+		{ ret: null, jwt: null }, { ret: null, jwt: null }, { ret: null }
 	], await Promise.all([
 		pos(""), pos("", ""), pos(json({ psg: "pas" }), "invalidkey")
 	]))
@@ -27,7 +27,7 @@ Deno.test("pas", async () => {
 	const { ret: sms } = await pos(json({ psg: "sms", nbr, sms: false })) as { ret: PsgRet["sms"] }
 	assertEquals(true, sms && !sms.sms && is_utc(sms.utc!))
 	const code = await usr_r({ nbr }, { sms: 1 })
-	const { ret: pas, jwt } = await pos(json({ psg: "code", nbr, code: code?.sms?.code! })) as PosRet["psg"] & { ret: PsgRet["code"] }
+	const { ret: pas, jwt } = await pos(json({ psg: "code", nbr, code: code?.sms?.code! })) as PosRet & { ret: PsgRet["code"] }
 	assertEquals(true, pas && pas.usr == usr && jwt!.length > 0)
 	assertEquals({ ret: pas }, await pos(json({ psg: "pas" }), jwt!))
 	assertEquals({ ret: 1, jwt: null }, await pos(json({ psg: "clr", usr: pas!.usr }), jwt!))
@@ -53,7 +53,7 @@ Deno.test("pos", async () => {
 	const u2 = (await usr_c(nbr[1], adm1, adm2))!
 	await pos(json({ psg: "sms", nbr: nbr[1], sms: false }))
 	const { sms } = (await usr_r({ _id: u2 }, { sms: 1 }))!
-	const { jwt } = (await pos(json({ psg: "code", nbr: nbr[1], code: sms!.code })))! as PosRet["psg"]
+	const { jwt } = (await pos(json({ psg: "code", nbr: nbr[1], code: sms!.code })))! as PosRet
 	assertEquals([
 		3, 1,
 		null, null, null, null, null, null,