Refactor config management to use Drizzle ORM

- Replaced Sequelize with Drizzle ORM in config-related routes and models. - Updated database queries to use Drizzle's syntax for selecting, inserting, updating, and deleting configurations. - Removed the ConfigModel class and replaced it with direct database interactions. - Introduced nanoid for generating unique IDs for new configurations. - Added new routes for managing marks, including CRUD operations and versioning. - Implemented transaction handling for critical operations in the MarkModel. - Enhanced error handling and validation in routes.
修复用户应用键的分隔符，从 '-' 更改为 '--'，以保持一致性并优化 WebSocket 连接管理
2026-02-05 16:31:11 +08:00 · 2026-02-05 14:08:45 +08:00 · 2026-02-05 13:38:55 +08:00 · 2026-02-05 04:58:28 +08:00 · 2026-02-05 04:50:54 +08:00 · 2026-02-05 04:06:34 +08:00
37 changed files with 1327 additions and 1630 deletions
--- a/package.json
+++ b/package.json
@@ -49,7 +49,8 @@
  "dependencies": {
    "@kevisual/ai": "^0.0.24",
    "@kevisual/auth": "^2.0.3",
-    "@kevisual/query": "^0.0.38",
+    "@kevisual/js-filter": "^0.0.5",
+    "@kevisual/query": "^0.0.39",
    "@types/busboy": "^1.5.4",
    "@types/send": "^1.2.1",
    "@types/ws": "^8.18.1",
@@ -71,22 +72,23 @@
    "zod-to-json-schema": "^3.25.1"
  },
  "devDependencies": {
-    "@aws-sdk/client-s3": "^3.980.0",
+    "@aws-sdk/client-s3": "^3.981.0",
+    "@kevisual/api": "^0.0.44",
    "@kevisual/code-center-module": "0.0.24",
    "@kevisual/context": "^0.0.4",
    "@kevisual/file-listener": "^0.0.2",
    "@kevisual/local-app-manager": "0.1.32",
    "@kevisual/logger": "^0.0.4",
-    "@kevisual/oss": "0.0.18",
-    "@kevisual/permission": "^0.0.3",
-    "@kevisual/router": "0.0.65",
+    "@kevisual/oss": "0.0.19",
+    "@kevisual/permission": "^0.0.4",
+    "@kevisual/router": "0.0.70",
    "@kevisual/types": "^0.0.12",
-    "@kevisual/use-config": "^1.0.28",
+    "@kevisual/use-config": "^1.0.30",
    "@types/archiver": "^7.0.0",
    "@types/bun": "^1.3.8",
    "@types/crypto-js": "^4.2.2",
    "@types/jsonwebtoken": "^9.0.10",
-    "@types/node": "^25.1.0",
+    "@types/node": "^25.2.0",
    "@types/pg": "^8.16.0",
    "@types/semver": "^7.7.1",
    "@types/xml2js": "^0.4.14",
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
--- a/src/auth/models/user.ts
+++ b/src/auth/models/user.ts
@@ -62,7 +62,13 @@ export class User extends Model {
      oauthUser.orgId = id;
    }
    const token = await oauth.generateToken(oauthUser, { type: loginType, hasRefreshToken: true, ...expand });
-    return { accessToken: token.accessToken, refreshToken: token.refreshToken, token: token.accessToken };
+    return {
+      accessToken: token.accessToken,
+      refreshToken: token.refreshToken,
+      token: token.accessToken,
+      refreshTokenExpiresIn: token.refreshTokenExpiresIn,
+      accessTokenExpiresIn: token.accessTokenExpiresIn,
+    };
  }
  /**
   * 验证token
--- a/src/auth/oauth/oauth.ts
+++ b/src/auth/oauth/oauth.ts
@@ -70,9 +70,16 @@ interface Store<T> {
  expire: (key: string, ttl?: number) => Promise<void>;
  delObject: (value?: T) => Promise<void>;
  keys: (key?: string) => Promise<string[]>;
-  setToken: (value: { accessToken: string; refreshToken: string; value?: T }, opts?: StoreSetOpts) => Promise<void>;
+  setToken: (value: { accessToken: string; refreshToken: string; value?: T }, opts?: StoreSetOpts) => Promise<TokenData>;
  delKeys: (keys: string[]) => Promise<number>;
 }
+
+type TokenData = {
+  accessToken: string;
+  accessTokenExpiresIn?: number;
+  refreshToken?: string;
+  refreshTokenExpiresIn?: number;
+}
 export class RedisTokenStore implements Store<OauthUser> {
  redis: Redis;
  private prefix: string = 'oauth:';
@@ -131,7 +138,7 @@ export class RedisTokenStore implements Store<OauthUser> {
      await this.del(userPrefix + ':token:' + accessToken);
    }
  }
-  async setToken(data: { accessToken: string; refreshToken: string; value?: OauthUser }, opts?: StoreSetOpts) {
+  async setToken(data: { accessToken: string; refreshToken: string; value?: OauthUser }, opts?: StoreSetOpts): Promise<TokenData> {
    const { accessToken, refreshToken, value } = data;
    let userPrefix = 'user:' + value?.id;
    if (value?.orgId) {
@@ -163,14 +170,20 @@ export class RedisTokenStore implements Store<OauthUser> {

    await this.set(accessToken, JSON.stringify(value), expire);
    await this.set(userPrefix + ':token:' + accessToken, accessToken, expire);
+    let refreshTokenExpiresIn = Math.min(expire * 7, 60 * 60 * 24 * 30, 60 * 60 * 24 * 365); // 最大为一年
    if (refreshToken) {
-      let refreshTokenExpire = Math.min(expire * 7, 60 * 60 * 24 * 30, 60 * 60 * 24 * 365); // 最大为一年
      // 小于7天, 则设置为7天
-      if (refreshTokenExpire < 60 * 60 * 24 * 7) {
-        refreshTokenExpire = 60 * 60 * 24 * 7;
+      if (refreshTokenExpiresIn < 60 * 60 * 24 * 7) {
+        refreshTokenExpiresIn = 60 * 60 * 24 * 7;
      }
-      await this.set(refreshToken, JSON.stringify(value), refreshTokenExpire);
-      await this.set(userPrefix + ':refreshToken:' + refreshToken, refreshToken, refreshTokenExpire);
+      await this.set(refreshToken, JSON.stringify(value), refreshTokenExpiresIn);
+      await this.set(userPrefix + ':refreshToken:' + refreshToken, refreshToken, refreshTokenExpiresIn);
+    }
+    return {
+      accessToken,
+      accessTokenExpiresIn: expire,
+      refreshToken,
+      refreshTokenExpiresIn: refreshTokenExpiresIn,
    }
  }
  async delKeys(keys: string[]) {
@@ -206,10 +219,7 @@ export class OAuth<T extends OauthUser> {
  async generateToken(
    user: T,
    expandOpts?: StoreSetOpts,
-  ): Promise<{
-    accessToken: string;
-    refreshToken?: string;
-  }> {
+  ): Promise<TokenData> {
    // 拥有refreshToken 为 true 时，accessToken 为 st_ 开头，refreshToken 为 rk_开头
    // 意思是secretToken 和 secretKey的缩写
    const accessToken = expandOpts?.hasRefreshToken ? 'st_' + randomId32() : 'sk_' + randomId64();
@@ -227,9 +237,9 @@ export class OAuth<T extends OauthUser> {
        user.oauthExpand.refreshToken = refreshToken;
      }
    }
-    await this.store.setToken({ accessToken, refreshToken, value: user }, expandOpts);
+    const tokenData = await this.store.setToken({ accessToken, refreshToken, value: user }, expandOpts);

-    return { accessToken, refreshToken };
+    return tokenData;
  }
  async saveSecretKey(oauthUser: T, secretKey: string, opts?: StoreSetOpts) {
    // 生成一个secretKey
--- a/src/modules/fm-manager/get-content-type.ts
+++ b/src/modules/fm-manager/get-content-type.ts
@@ -11,7 +11,6 @@ export const getTextContentType = (filePath: string, isFilePath = false) => {
    '.env',
    '.example',
    '.log',
-    '.mjs',
    '.map',
    '.json5',
    '.pem',
--- a/src/modules/fm-manager/proxy/ai-proxy.ts
+++ b/src/modules/fm-manager/proxy/ai-proxy.ts
@@ -54,6 +54,14 @@ export const getFileList = async (list: any, opts?: { objectName: string; app: s
  });
 };
 // import { logger } from '@/module/logger.ts';
+/**
+ * GET 处理 AI 代理请求
+ * 1. 如果是目录请求，返回目录列表
+ * 2. 如果是文件请求，返回文件流
+ * 
+ * 如果是 stat
+ * 只返回对应的 stat 信息 
+*/
 const getAiProxy = async (req: IncomingMessage, res: ServerResponse, opts: ProxyOptions) => {
  const { createNotFoundPage } = opts;
  const _u = new URL(req.url, 'http://localhost');
@@ -63,6 +71,7 @@ const getAiProxy = async (req: IncomingMessage, res: ServerResponse, opts: Proxy
  const hash = params.get('hash');
  let dir = !!params.get('dir');
  const recursive = !!params.get('recursive');
+  const showStat = !!params.get('stat');
  const { objectName, app, owner, loginUser, isOwner } = await getObjectName(req);
  if (!dir && _u.pathname.endsWith('/')) {
    dir = true; // 如果是目录请求，强制设置为true
@@ -89,10 +98,19 @@ const getAiProxy = async (req: IncomingMessage, res: ServerResponse, opts: Proxy
      return true;
    }
    const stat = await oss.statObject(objectName);
-    if (!stat) {
-      createNotFoundPage('Invalid proxy url');
+    if (!stat && isOwner) {
+      // createNotFoundPage('文件不存在');
+      res.writeHead(200, { 'content-type': 'application/json' });
+      res.end(
+        JSON.stringify({
+          code: 404,
+          message: 'object not found',
+        }),
+      );
      logger.debug('no stat', objectName, owner, req.url);
      return true;
+    } else if (!stat && !isOwner) {
+      return createNotFoundPage('Invalid ai proxy url');
    }
    const permissionInstance = new UserPermission({ permission: stat.metaData as Permission, owner: owner });
    const checkPermission = permissionInstance.checkPermissionSuccess({
@@ -103,6 +121,20 @@ const getAiProxy = async (req: IncomingMessage, res: ServerResponse, opts: Proxy
      logger.info('no permission', checkPermission, loginUser, owner);
      return createNotFoundPage('no permission');
    }
+
+    if (showStat) {
+      res.writeHead(200, { 'content-type': 'application/json' });
+      res.end(
+        JSON.stringify({
+          code: 200,
+          data: {
+            ...stat,
+            metaData: filterKeys(stat.metaData, ['etag', 'size']),
+          },
+        }),
+      );
+      return true;
+    }
    if (hash && stat.etag === hash) {
      res.writeHead(304); // not modified
      res.end('not modified');
@@ -295,6 +327,48 @@ export const renameProxy = async (req: IncomingMessage, res: ServerResponse, opt
  }
 };

+export const updateMetadataProxy = async (req: IncomingMessage, res: ServerResponse, opts: ProxyOptions) => {
+  const { objectName, isOwner } = await getObjectName(req);
+  let oss = opts.oss;
+  if (!isOwner) {
+    return opts?.createNotFoundPage?.('no permission');
+  }
+  const end = (data: any, message?: string, code = 200) => {
+    res.writeHead(code, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ code: code, data: data, message: message || 'success' }));
+  };
+  const _u = new URL(req.url, 'http://localhost');
+  const params = _u.searchParams;
+  const metaParam = params.get('meta');
+  if (!metaParam) {
+    return end({ success: false }, 'meta parameter required', 400);
+  }
+  const meta = parseSearchValue(metaParam, { decode: true });
+  try {
+    const stat = await oss.statObject(objectName);
+    if (!stat) {
+      return end({ success: false }, 'object not found', 404);
+    }
+    const newMeta = {
+      "app-source": "user-app",
+      ...meta,
+    };
+    console.log('update metadata', objectName, newMeta);
+    // 过滤掉包含无效字符的 key（S3 元数据头不支持某些字符）
+    const filteredMeta: Record<string, string> = {};
+    for (const [key, value] of Object.entries(newMeta)) {
+      if (/^[\w\-]+$/.test(key)) {
+        filteredMeta[key] = String(value);
+      }
+    }
+    await oss.replaceObject(objectName, filteredMeta);
+    end({ success: true, objectName, meta }, 'update metadata success', 200);
+  } catch (error) {
+    logger.error('updateMetadataProxy error', error);
+    end({ success: false, error }, 'update metadata failed', 500);
+  }
+};
+
 export type ProxyOptions = {
  createNotFoundPage: (msg?: string) => any;
  oss?: OssBase;
@@ -303,8 +377,8 @@ export const aiProxy = async (req: IncomingMessage, res: ServerResponse, opts: P
  if (!opts.oss) {
    opts.oss = oss;
  }
-  if (req.method === 'POST') {
  const searchParams = new URL(req.url || '', 'http://localhost').searchParams;
+  if (req.method === 'POST') {
    const chunk = searchParams.get('chunk');
    const chunked = searchParams.get('chunked');
    if (chunk !== null || chunked !== null) {
@@ -316,6 +390,10 @@ export const aiProxy = async (req: IncomingMessage, res: ServerResponse, opts: P
    return deleteProxy(req, res, opts);
  }
  if (req.method === 'PUT') {
+    const meta = searchParams.get('meta');
+    if (meta) {
+      return updateMetadataProxy(req, res, opts);
+    }
    return renameProxy(req, res, opts);
  }

--- a/src/modules/html/studio-app-list/index.ts
+++ b/src/modules/html/studio-app-list/index.ts
@@ -3,11 +3,11 @@ export const createStudioAppListHtml = (opts: StudioOpts) => {
  const user = opts.user!;
  const userAppKey = opts?.userAppKey;
  let showUserAppKey = userAppKey;
-  if (showUserAppKey && showUserAppKey.startsWith(user + '-')) {
-    showUserAppKey = showUserAppKey.replace(user + '-', '');
+  if (showUserAppKey && showUserAppKey.startsWith(user + '--')) {
+    showUserAppKey = showUserAppKey.replace(user + '--', '');
  }
  const pathApps = opts?.appIds?.map(appId => {
-    const shortAppId = appId.replace(opts!.user + '-', '')
+    const shortAppId = appId.replace(opts!.user + '--', '')
    return {
      appId,
      shortAppId,
--- a/src/modules/ws-proxy/index.ts
+++ b/src/modules/ws-proxy/index.ts
@@ -20,8 +20,14 @@ export const wssFun: WebSocketListenerFun = async (req, res) => {
      return;
    }
    const user = loginUser?.tokenUser?.username;
-    const userApp = user + '-' + id;
+    const userApp = user + '--' + id;
    logger.debug('注册 ws 连接', userApp);
+    const wsMessage = wsProxyManager.get(userApp);
+    if (wsMessage) {
+      logger.debug('ws 连接已存在，关闭旧连接', userApp);
+      wsMessage.ws.close();
+      wsProxyManager.unregister(userApp);
+    }
    // @ts-ignore
    wsProxyManager.register(userApp, { user, ws });
    ws.send(
--- a/src/modules/ws-proxy/manager.ts
+++ b/src/modules/ws-proxy/manager.ts
@@ -2,21 +2,51 @@ import { nanoid } from 'nanoid';
 import { WebSocket } from 'ws';
 import { logger } from '../logger.ts';
 import { EventEmitter } from 'eventemitter3';
+import { set } from 'zod';
+
 class WsMessage {
  ws: WebSocket;
  user?: string;
-  emitter: EventEmitter;;
+  emitter: EventEmitter;
+  private pingTimer?: NodeJS.Timeout;
+  private readonly PING_INTERVAL = 30000; // 30 秒发送一次 ping
+
  constructor({ ws, user }: WssMessageOptions) {
    this.ws = ws;
    this.user = user;
    this.emitter = new EventEmitter();
+    this.startPing();
  }
+
+  private startPing() {
+    this.stopPing();
+    this.pingTimer = setInterval(() => {
+      if (this.ws.readyState === WebSocket.OPEN) {
+        this.ws.ping();
+      } else {
+        this.stopPing();
+      }
+    }, this.PING_INTERVAL);
+  }
+
+  private stopPing() {
+    if (this.pingTimer) {
+      clearInterval(this.pingTimer);
+      this.pingTimer = undefined;
+    }
+  }
+
+  destroy() {
+    this.stopPing();
+    this.emitter.removeAllListeners();
+  }
+
  async sendResponse(data: any) {
    if (data.id) {
      this.emitter.emit(data.id, data?.data);
    }
  }
-  async sendData(data: any, opts?: { timeout?: number }) {
+  async sendData(data: any, context?: any, opts?: { timeout?: number }) {
    if (this.ws.readyState !== WebSocket.OPEN) {
      return { code: 500, message: 'WebSocket is not open' };
    }
@@ -25,7 +55,10 @@ class WsMessage {
    const message = JSON.stringify({
      id,
      type: 'proxy',
-      data,
+      data: {
+        message: data,
+        context: context || {},
+      },
    });
    logger.info('ws-proxy sendData', message);
    this.ws.send(message);
@@ -50,15 +83,22 @@ type WssMessageOptions = {
 };
 export class WsProxyManager {
  wssMap: Map<string, WsMessage> = new Map();
-  constructor() { }
+  PING_INTERVAL = 30000; // 30 秒检查一次连接状态
+  constructor(opts?: { pingInterval?: number }) {
+    if (opts?.pingInterval) {
+      this.PING_INTERVAL = opts.pingInterval;
+    }
+    this.checkConnceted();
+  }
  register(id: string, opts?: { ws: WebSocket; user: string }) {
    if (this.wssMap.has(id)) {
      const value = this.wssMap.get(id);
      if (value) {
        value.ws.close();
+        value.destroy();
      }
    }
-    const [username, appId] = id.split('-');
+    const [username, appId] = id.split('--');
    const url = new URL(`/${username}/v1/${appId}`, 'https://kevisual.cn/');
    console.log('WsProxyManager register', id, '访问地址', url.toString());
    const value = new WsMessage({ ws: opts?.ws, user: opts?.user });
@@ -68,6 +108,7 @@ export class WsProxyManager {
    const value = this.wssMap.get(id);
    if (value) {
      value.ws.close();
+      value.destroy();
    }
    this.wssMap.delete(id);
  }
@@ -80,4 +121,16 @@ export class WsProxyManager {
  get(id: string) {
    return this.wssMap.get(id);
  }
+  checkConnceted() {
+    const that = this;
+    setTimeout(() => {
+      that.wssMap.forEach((value, key) => {
+        if (value.ws.readyState !== WebSocket.OPEN) {
+          logger.debug('ws not connected, unregister', key);
+          that.unregister(key);
+        }
+      });
+      that.checkConnceted();
+    }, this.PING_INTERVAL);
+  }
 }
--- a/src/modules/ws-proxy/proxy.ts
+++ b/src/modules/ws-proxy/proxy.ts
@@ -5,6 +5,7 @@ import { App } from '@kevisual/router';
 import { logger } from '../logger.ts';
 import { getLoginUser } from '@/modules/auth.ts';
 import { createStudioAppListHtml } from '../html/studio-app-list/index.ts';
+import { omit } from 'es-toolkit';

 type ProxyOptions = {
  createNotFoundPage: (msg?: string) => any;
@@ -31,7 +32,7 @@ export const UserV1Proxy = async (req: IncomingMessage, res: ServerResponse, opt
  if (!userAppKey) {
    if (isAdmin) {
      // 获取所有的管理员的应用列表
-      const ids = wsProxyManager.getIds(user + '-');
+      const ids = wsProxyManager.getIds(user + '--');
      const html = createStudioAppListHtml({ user, appIds: ids, userAppKey });
      res.writeHead(200, { 'Content-Type': 'text/html' });
      res.end(html);
@@ -41,8 +42,8 @@ export const UserV1Proxy = async (req: IncomingMessage, res: ServerResponse, opt
      return false;
    }
  }
-  if (!userAppKey.includes('-')) {
-    userAppKey = user + '-' + userAppKey;
+  if (!userAppKey.includes('--')) {
+    userAppKey = user + '--' + userAppKey;
  }

  // TODO: 如果不是管理员，是否需要添加其他人可以访问的逻辑？
@@ -50,12 +51,12 @@ export const UserV1Proxy = async (req: IncomingMessage, res: ServerResponse, opt
    opts?.createNotFoundPage?.('没有访问应用权限');
    return false;
  }
-  if (!userAppKey.startsWith(user + '-')) {
-    userAppKey = user + '-' + userAppKey;
+  if (!userAppKey.startsWith(user + '--')) {
+    userAppKey = user + '--' + userAppKey;
  }
  logger.debug('data', data);
  const client = wsProxyManager.get(userAppKey);
-  const ids = wsProxyManager.getIds(user + '-');
+  const ids = wsProxyManager.getIds(user + '--');
  if (!client) {
    if (isAdmin) {
      const html = createStudioAppListHtml({ user, appIds: ids, userAppKey });
@@ -74,7 +75,13 @@ export const UserV1Proxy = async (req: IncomingMessage, res: ServerResponse, opt
    res.end(await html);
    return true;
  }
-  const value = await client.sendData(data);
+  let message: any = data;
+  if (!isAdmin) {
+    message = omit(data, ['token', 'cookies']);
+  }
+  const value = await client.sendData(message, {
+    state: { tokenUser: omit(loginUser.tokenUser, ['oauthExpand']) },
+  });
  if (value) {
    res.writeHead(200, { 'Content-Type': 'application/json' });
    res.end(JSON.stringify(value));
--- a/src/routes-simple/code/upload.ts
+++ b/src/routes-simple/code/upload.ts
@@ -1,171 +0,0 @@
-import Busboy from 'busboy';
-import { checkAuth } from '../middleware/auth.ts';
-import { router, clients, writeEvents } from '../router.ts';
-import { error } from '../middleware/auth.ts';
-import fs from 'fs';
-import { useFileStore } from '@kevisual/use-config';
-import { app, oss } from '@/app.ts';
-import { getContentType } from '@/utils/get-content-type.ts';
-import path from 'path';
-import { createWriteStream } from 'fs';
-import crypto from 'crypto';
-import { pipeBusboy } from '@/modules/fm-manager/index.ts';
-const cacheFilePath = useFileStore('cache-file', { needExists: true });
-
-router.post('/api/micro-app/upload', async (req, res) => {
-  if (res.headersSent) return; // 如果响应已发送,不再处理
-  res.writeHead(200, { 'Content-Type': 'application/json' });
-  const { tokenUser, token } = await checkAuth(req, res);
-  if (!tokenUser) return;
-
-  // 使用 busboy 解析 multipart/form-data
-  const busboy = Busboy({ headers: req.headers, preservePath: true, defCharset: 'utf-8' });
-  const fields: any = {};
-  let file: any = null;
-  let filePromise: Promise<void> | null = null;
-  let bytesReceived = 0;
-  let bytesExpected = parseInt(req.headers['content-length'] || '0');
-
-  busboy.on('field', (fieldname, value) => {
-    fields[fieldname] = value;
-  });
-
-  busboy.on('file', (fieldname, fileStream, info) => {
-    const { filename, encoding, mimeType } = info;
-    // 处理 UTF-8 文件名编码
-    const decodedFilename = typeof filename === 'string' ? Buffer.from(filename, 'latin1').toString('utf8') : filename;
-    const tempPath = path.join(cacheFilePath, `${Date.now()}-${Math.random().toString(36).substring(7)}`);
-    const writeStream = createWriteStream(tempPath);
-    const hash = crypto.createHash('md5');
-    let size = 0;
-
-    filePromise = new Promise<void>((resolve, reject) => {
-      fileStream.on('data', (chunk) => {
-        bytesReceived += chunk.length;
-        size += chunk.length;
-        hash.update(chunk);
-        if (bytesExpected > 0) {
-          const progress = (bytesReceived / bytesExpected) * 100;
-          console.log(`Upload progress: ${progress.toFixed(2)}%`);
-          const data = {
-            progress: progress.toFixed(2),
-            message: `Upload progress: ${progress.toFixed(2)}%`,
-          };
-          writeEvents(req, data);
-        }
-      });
-
-      fileStream.pipe(writeStream);
-
-      writeStream.on('finish', () => {
-        file = {
-          filepath: tempPath,
-          originalFilename: decodedFilename,
-          mimetype: mimeType,
-          hash: hash.digest('hex'),
-          size: size,
-        };
-        resolve();
-      });
-
-      writeStream.on('error', (err) => {
-        reject(err);
-      });
-    });
-  });
-
-  busboy.on('finish', async () => {
-    // 等待文件写入完成
-    if (filePromise) {
-      try {
-        await filePromise;
-      } catch (err) {
-        console.error(`File write error: ${err.message}`);
-        res.end(error(`File write error: ${err.message}`));
-        return;
-      }
-    }
-    const clearFiles = () => {
-      if (file?.filepath && fs.existsSync(file.filepath)) {
-        fs.unlinkSync(file.filepath);
-      }
-    };
-
-    if (!file) {
-      res.end(error('No file uploaded'));
-      return;
-    }
-
-    let appKey, collection;
-    const { appKey: _appKey, collection: _collecion } = fields;
-    if (Array.isArray(_appKey)) {
-      appKey = _appKey?.[0];
-    } else {
-      appKey = _appKey;
-    }
-    if (Array.isArray(_collecion)) {
-      collection = _collecion?.[0];
-    } else {
-      collection = _collecion;
-    }
-    collection = parseIfJson(collection);
-
-    appKey = appKey || 'micro-app';
-    console.log('Appkey', appKey);
-    console.log('collection', collection);
-
-    // 处理上传的文件
-    const uploadResults = [];
-    const tempPath = file.filepath; // 文件上传时的临时路径
-    const relativePath = file.originalFilename; // 保留表单中上传的文件名 (包含文件夹结构)
-    // 比如 child2/b.txt
-    const minioPath = `private/${tokenUser.username}/${appKey}/${relativePath}`;
-    // 上传到 MinIO 并保留文件夹结构
-    const isHTML = relativePath.endsWith('.html');
-    await oss.fPutObject(minioPath, tempPath, {
-      'Content-Type': getContentType(relativePath),
-      'app-source': 'user-micro-app',
-      'Cache-Control': isHTML ? 'no-cache' : 'max-age=31536000, immutable', // 缓存一年
-    });
-    uploadResults.push({
-      name: relativePath,
-      path: minioPath,
-      hash: file.hash,
-      size: file.size,
-    });
-    fs.unlinkSync(tempPath); // 删除临时文件
-
-    // 受控
-    const r = await app.call({
-      path: 'micro-app',
-      key: 'upload',
-      payload: {
-        token: token,
-        data: {
-          appKey,
-          collection,
-          files: uploadResults,
-        },
-      },
-    });
-    const data: any = {
-      code: r.code,
-      data: r.body,
-    };
-    if (r.message) {
-      data.message = r.message;
-    }
-    res.end(JSON.stringify(data));
-  });
-
-  pipeBusboy(req, res, busboy);
-});
-
-
-function parseIfJson(collection: any): any {
-  try {
-    return JSON.parse(collection);
-  } catch (e) {
-    return collection;
-  }
-}
--- a/src/routes-simple/event.ts
+++ b/src/routes-simple/event.ts
@@ -1,49 +0,0 @@
-import { router, error, checkAuth, clients, getTaskId, writeEvents, deleteOldClients } from './router.ts';
-
-router.get('/api/events', async (req, res) => {
-  res.writeHead(200, {
-    'Content-Type': 'text/event-stream',
-    'Cache-Control': 'no-cache',
-    Connection: 'keep-alive',
-  });
-  const taskId = getTaskId(req);
-  if (!taskId) {
-    res.end(error('task-id is required'));
-    return;
-  }
-  // 将客户端连接推送到 clients 数组
-  clients.set(taskId, { client: res, createTime: Date.now() });
-  // 移除客户端连接
-  req.on('close', () => {
-    clients.delete(taskId);
-  });
-});
-
-router.get('/api/s1/events', async (req, res) => {
-  res.writeHead(200, {
-    'Content-Type': 'text/event-stream',
-    'Cache-Control': 'no-cache',
-    Connection: 'keep-alive',
-  });
-  const taskId = getTaskId(req);
-  if (!taskId) {
-    res.end(error('task-id is required'));
-    return;
-  }
-  // 将客户端连接推送到 clients 数组
-  clients.set(taskId, { client: res, createTime: Date.now() });
-  writeEvents(req, { progress: 0, message: 'start' });
-  // 不自动关闭连接
-  // res.end('ok');
-});
-
-router.get('/api/s1/events/close', async (req, res) => {
-  const taskId = getTaskId(req);
-  if (!taskId) {
-    res.end(error('task-id is required'));
-    return;
-  }
-  deleteOldClients();
-  clients.delete(taskId);
-  res.end('ok');
-});
--- a/src/routes-simple/handle-request.ts
+++ b/src/routes-simple/handle-request.ts
@@ -1,20 +1,9 @@
-import { useFileStore } from '@kevisual/use-config';
 import http from 'node:http';
-import fs from 'fs';
-import Busboy from 'busboy';
-import { app, oss } from '@/app.ts';
-
-import { getContentType } from '@/utils/get-content-type.ts';
-import { User } from '@/models/user.ts';
-import { router, error, checkAuth, writeEvents } from './router.ts';
+import { router } from './router.ts';
 import './index.ts';
 import { handleRequest as PageProxy } from './page-proxy.ts';

 const simpleAppsPrefixs = [
-  "/api/micro-app/",
-  "/api/events",
-  "/api/s1/",
-  "/api/resource/",
  "/api/wxmsg"
 ];

--- a/src/routes-simple/index.ts
+++ b/src/routes-simple/index.ts
@@ -1,6 +0,0 @@
-// import './code/upload.ts';
-import './event.ts';
-
-import './resources/upload.ts';
-import './resources/chunk.ts';
-// import './resources/get-resources.ts';
--- a/src/routes-simple/middleware/auth.ts
+++ b/src/routes-simple/middleware/auth.ts
@@ -1,61 +0,0 @@
-import { User } from '@/models/user.ts';
-import http from 'http';
-import { parse } from '@kevisual/router/src/server/cookie.ts';
-export const error = (msg: string, code = 500) => {
-  return JSON.stringify({ code, message: msg });
-};
-export const checkAuth = async (req: http.IncomingMessage, res: http.ServerResponse) => {
-  let token = (req.headers?.['authorization'] as string) || (req.headers?.['Authorization'] as string) || '';
-  const url = new URL(req.url || '', 'http://localhost');
-  const resNoPermission = () => {
-    res.statusCode = 401;
-    res.end(error('Invalid authorization'));
-    return { tokenUser: null, token: null };
-  };
-  if (!token) {
-    token = url.searchParams.get('token') || '';
-  }
-  if (!token) {
-    const parsedCookies = parse(req.headers.cookie || '');
-    token = parsedCookies.token || '';
-  }
-  if (!token) {
-    return resNoPermission();
-  }
-  if (token) {
-    token = token.replace('Bearer ', '');
-  }
-  let tokenUser;
-  try {
-    tokenUser = await User.verifyToken(token);
-  } catch (e) {
-    console.log('checkAuth error', e);
-    res.statusCode = 401;
-    res.end(error('Invalid token'));
-    return { tokenUser: null, token: null };
-  }
-  return { tokenUser, token };
-};
-
-export const getLoginUser = async (req: http.IncomingMessage) => {
-  let token = (req.headers?.['authorization'] as string) || (req.headers?.['Authorization'] as string) || '';
-  const url = new URL(req.url || '', 'http://localhost');
-  if (!token) {
-    token = url.searchParams.get('token') || '';
-  }
-  if (!token) {
-    const parsedCookies = parse(req.headers.cookie || '');
-    token = parsedCookies.token || '';
-  }
-
-  if (token) {
-    token = token.replace('Bearer ', '');
-  }
-  let tokenUser;
-  try {
-    tokenUser = await User.verifyToken(token);
-    return { tokenUser, token };
-  } catch (e) {
-    return null;
-  }
-};
--- a/src/routes-simple/middleware/index.ts
+++ b/src/routes-simple/middleware/index.ts
@@ -1 +0,0 @@
-export * from './auth.ts'
--- a/src/routes-simple/page-proxy.ts
+++ b/src/routes-simple/page-proxy.ts
@@ -298,6 +298,7 @@ export const handleRequest = async (req: http.IncomingMessage, res: http.ServerR
      username: loginUser?.tokenUser?.username || '',
      password: password,
    });
+    console.log('checkPermission', checkPermission, 'loginUser:', loginUser, password)
    if (!checkPermission.success) {
      return createNotFoundPage('no permission');
    }
--- a/src/routes-simple/resources/chunk.ts
+++ b/src/routes-simple/resources/chunk.ts
@@ -1,237 +0,0 @@
-import { useFileStore } from '@kevisual/use-config';
-import { checkAuth, error, router, writeEvents, getKey, getTaskId } from '../router.ts';
-import Busboy from 'busboy';
-import { app, oss } from '@/app.ts';
-
-import { getContentType } from '@/utils/get-content-type.ts';
-import { User } from '@/models/user.ts';
-import fs from 'fs';
-import { ConfigModel } from '@/routes/config/models/model.ts';
-import { validateDirectory } from './util.ts';
-import path from 'path';
-import { createWriteStream } from 'fs';
-import { pipeBusboy } from '@/modules/fm-manager/index.ts';
-
-const cacheFilePath = useFileStore('cache-file', { needExists: true });
-
-router.get('/api/s1/resources/upload/chunk', async (req, res) => {
-  res.writeHead(200, { 'Content-Type': 'text/plain' });
-  res.end('Upload API is ready');
-});
-
-// /api/s1/resources/upload
-router.post('/api/s1/resources/upload/chunk', async (req, res) => {
-  const { tokenUser, token } = await checkAuth(req, res);
-  if (!tokenUser) return;
-  const url = new URL(req.url || '', 'http://localhost');
-  const share = !!url.searchParams.get('public');
-  const noCheckAppFiles = !!url.searchParams.get('noCheckAppFiles');
-
-  const taskId = getTaskId(req);
-  const finalFilePath = `${cacheFilePath}/${taskId}`;
-  if (!taskId) {
-    res.end(error('taskId is required'));
-    return;
-  }
-
-  // 使用 busboy 解析 multipart/form-data
-  const busboy = Busboy({ headers: req.headers, preservePath: true, defCharset: 'utf-8' });
-  const fields: any = {};
-  let file: any = null;
-  let tempPath = '';
-  let filePromise: Promise<void> | null = null;
-
-  busboy.on('field', (fieldname, value) => {
-    fields[fieldname] = value;
-  });
-
-  busboy.on('file', (fieldname, fileStream, info) => {
-    const { filename, encoding, mimeType } = info;
-    // 处理 UTF-8 文件名编码
-    const decodedFilename = typeof filename === 'string' ? Buffer.from(filename, 'latin1').toString('utf8') : filename;
-    tempPath = path.join(cacheFilePath, `${Date.now()}-${Math.random().toString(36).substring(7)}`);
-    const writeStream = createWriteStream(tempPath);
-
-    filePromise = new Promise<void>((resolve, reject) => {
-      fileStream.pipe(writeStream);
-
-      writeStream.on('finish', () => {
-        file = {
-          filepath: tempPath,
-          originalFilename: decodedFilename,
-          mimetype: mimeType,
-        };
-        resolve();
-      });
-
-      writeStream.on('error', (err) => {
-        reject(err);
-      });
-    });
-  });
-
-  busboy.on('finish', async () => {
-    // 等待文件写入完成
-    if (filePromise) {
-      try {
-        await filePromise;
-      } catch (err) {
-        console.error(`File write error: ${err.message}`);
-        res.end(error(`File write error: ${err.message}`));
-        return;
-      }
-    }
-    const clearFiles = () => {
-      if (tempPath && fs.existsSync(tempPath)) {
-        fs.unlinkSync(tempPath);
-      }
-      if (fs.existsSync(finalFilePath)) {
-        fs.unlinkSync(finalFilePath);
-      }
-    };
-
-    if (!file) {
-      res.end(error('No file uploaded'));
-      return;
-    }
-
-    // Handle chunked upload logic here
-    let { chunkIndex, totalChunks, appKey, version, username, directory } = getKey(fields, [
-      'chunkIndex',
-      'totalChunks',
-      'appKey',
-      'version',
-      'username',
-      'directory',
-    ]);
-    if (!chunkIndex || !totalChunks) {
-      res.end(error('chunkIndex, totalChunks is required'));
-      clearFiles();
-      return;
-    }
-    const relativePath = file.originalFilename;
-
-    const writeStream = fs.createWriteStream(finalFilePath, { flags: 'a' });
-    const readStream = fs.createReadStream(tempPath);
-    readStream.pipe(writeStream);
-
-    writeStream.on('finish', async () => {
-      fs.unlinkSync(tempPath); // 删除临时文件
-
-      // Write event for progress tracking
-      const progress = ((parseInt(chunkIndex) + 1) / parseInt(totalChunks)) * 100;
-      writeEvents(req, {
-        progress,
-        message: `Upload progress: ${progress}%`,
-      });
-
-      if (parseInt(chunkIndex) + 1 === parseInt(totalChunks)) {
-        let uid = tokenUser.id;
-        if (username) {
-          const user = await User.getUserByToken(token);
-          const has = await user.hasUser(username, true);
-          if (!has) {
-            res.end(error('username is not found'));
-            clearFiles();
-            return;
-          }
-          const _user = await User.findOne({ where: { username } });
-          uid = _user?.id || '';
-        }
-        if (!appKey || !version) {
-          const config = await ConfigModel.getUploadConfig({ uid });
-          if (config) {
-            appKey = config.config?.data?.key || '';
-            version = config.config?.data?.version || '';
-          }
-        }
-        if (!appKey || !version) {
-          res.end(error('appKey or version is not found, please check the upload config.'));
-          clearFiles();
-          return;
-        }
-        const { code, message } = validateDirectory(directory);
-        if (code !== 200) {
-          res.end(error(message));
-          clearFiles();
-          return;
-        }
-        const minioPath = `${username || tokenUser.username}/${appKey}/${version}${directory ? `/${directory}` : ''}/${relativePath}`;
-        const metadata: any = {};
-        if (share) {
-          metadata.share = 'public';
-        }
-        // All chunks uploaded, now upload to MinIO
-        await oss.fPutObject(minioPath, finalFilePath, {
-          'Content-Type': getContentType(relativePath),
-          'app-source': 'user-app',
-          'Cache-Control': relativePath.endsWith('.html') ? 'no-cache' : 'max-age=31536000, immutable',
-          ...metadata,
-        });
-
-        // Clean up the final file
-        fs.unlinkSync(finalFilePath);
-        const downloadBase = '/api/s1/share';
-
-        const uploadResult = {
-          name: relativePath,
-          path: `${downloadBase}/${minioPath}`,
-          appKey,
-          version,
-          username,
-        };
-        if (!noCheckAppFiles) {
-          // Notify the app
-          const r = await app.call({
-            path: 'app',
-            key: 'detectVersionList',
-            payload: {
-              token: token,
-              data: {
-                appKey,
-                version,
-                username,
-              },
-            },
-          });
-          const data: any = {
-            code: r.code,
-            data: {
-              app: r.body,
-              upload: [uploadResult],
-            },
-          };
-          if (r.message) {
-            data.message = r.message;
-          }
-          console.log('upload data', data);
-          res.writeHead(200, { 'Content-Type': 'application/json' });
-          res.end(JSON.stringify(data));
-        } else {
-          res.writeHead(200, { 'Content-Type': 'application/json' });
-          res.end(
-            JSON.stringify({
-              code: 200,
-              message: 'Chunk uploaded successfully',
-              data: { chunkIndex, totalChunks, upload: [uploadResult] },
-            }),
-          );
-        }
-      } else {
-        res.writeHead(200, { 'Content-Type': 'application/json' });
-        res.end(
-          JSON.stringify({
-            code: 200,
-            message: 'Chunk uploaded successfully',
-            data: {
-              chunkIndex,
-              totalChunks,
-            },
-          }),
-        );
-      }
-    });
-  });
-
-  pipeBusboy(req, res, busboy);
-});
--- a/src/routes-simple/resources/upload.ts
+++ b/src/routes-simple/resources/upload.ts
@@ -1,290 +0,0 @@
-import { useFileStore } from '@kevisual/use-config';
-import { checkAuth, error, router, writeEvents, getKey } from '../router.ts';
-import Busboy from 'busboy';
-import { app } from '@/app.ts';
-
-import { getContentType } from '@/utils/get-content-type.ts';
-import { User } from '@/models/user.ts';
-import fs from 'fs';
-import path from 'path';
-import { createWriteStream } from 'fs';
-import { pipeBusboy } from '@/modules/fm-manager/pipe-busboy.ts';
-import { ConfigModel } from '@/routes/config/models/model.ts';
-import { validateDirectory } from './util.ts';
-import { pick } from 'es-toolkit';
-import { getFileStat } from '@/routes/file/index.ts';
-import { logger } from '@/modules/logger.ts';
-import { oss } from '@/modules/s3.ts';
-
-const cacheFilePath = useFileStore('cache-file', { needExists: true });
-
-router.get('/api/s1/resources/upload', async (req, res) => {
-  res.writeHead(200, { 'Content-Type': 'text/plain' });
-  res.end('Upload API is ready');
-});
-export const parseIfJson = (data = '{}') => {
-  try {
-    const _data = JSON.parse(data);
-    if (typeof _data === 'object') return _data;
-    return {};
-  } catch (error) {
-    return {};
-  }
-};
-router.post('/api/s1/resources/upload/check', async (req, res) => {
-  const { tokenUser, token } = await checkAuth(req, res);
-  if (!tokenUser) {
-    res.end(error('Token is invalid.'));
-    return;
-  }
-  console.log('data', req.url);
-  res.writeHead(200, { 'Content-Type': 'application/json' });
-  const data = await router.getBody(req);
-  type Data = {
-    appKey: string;
-    version: string;
-    username: string;
-    directory: string;
-    files: { path: string; hash: string }[];
-  };
-  let { appKey, version, username, directory, files } = pick(data, ['appKey', 'version', 'username', 'directory', 'files']) as Data;
-  let uid = tokenUser.id;
-  if (username) {
-    const user = await User.getUserByToken(token);
-    const has = await user.hasUser(username, true);
-    if (!has) {
-      res.end(error('username is not found'));
-      return;
-    }
-    const _user = await User.findOne({ where: { username } });
-    uid = _user?.id || '';
-  }
-  if (!appKey || !version) {
-    res.end(error('appKey and version is required'));
-  }
-
-  const { code, message } = validateDirectory(directory);
-  if (code !== 200) {
-    res.end(error(message));
-    return;
-  }
-  type CheckResult = {
-    path: string;
-    stat: any;
-    resourcePath: string;
-    hash: string;
-    uploadHash: string;
-    isUpload?: boolean;
-  };
-  const checkResult: CheckResult[] = [];
-  for (let i = 0; i < files.length; i++) {
-    const file = files[i];
-    const relativePath = file.path;
-    const minioPath = `${username || tokenUser.username}/${appKey}/${version}${directory ? `/${directory}` : ''}/${relativePath}`;
-    let stat = await getFileStat(minioPath, true);
-    const statHash = stat?.etag || '';
-    checkResult.push({
-      path: relativePath,
-      uploadHash: file.hash,
-      resourcePath: minioPath,
-      isUpload: statHash === file.hash,
-      stat,
-      hash: statHash,
-    });
-  }
-  res.end(JSON.stringify({ code: 200, data: checkResult }));
-});
-
-// /api/s1/resources/upload
-router.post('/api/s1/resources/upload', async (req, res) => {
-  const { tokenUser, token } = await checkAuth(req, res);
-  if (!tokenUser) {
-    res.end(error('Token is invalid.'));
-    return;
-  }
-  const url = new URL(req.url || '', 'http://localhost');
-  const share = !!url.searchParams.get('public');
-  const meta = parseIfJson(url.searchParams.get('meta'));
-  const noCheckAppFiles = !!url.searchParams.get('noCheckAppFiles');
-  // 使用 busboy 解析 multipart/form-data
-  const busboy = Busboy({ headers: req.headers, preservePath: true, defCharset: 'utf-8' });
-  const fields: any = {};
-  const files: any[] = [];
-  const filePromises: Promise<void>[] = [];
-  let bytesReceived = 0;
-  let bytesExpected = parseInt(req.headers['content-length'] || '0');
-  busboy.on('field', (fieldname, value) => {
-    fields[fieldname] = value;
-  });
-
-  busboy.on('file', (fieldname, fileStream, info) => {
-    const { filename, encoding, mimeType } = info;
-    // 处理 UTF-8 文件名编码（busboy 可能返回 Latin-1 编码的缓冲区）
-    const decodedFilename = typeof filename === 'string' ? Buffer.from(filename, 'latin1').toString('utf8') : filename;
-    const tempPath = path.join(cacheFilePath, `${Date.now()}-${Math.random().toString(36).substring(7)}`);
-    const writeStream = createWriteStream(tempPath);
-    const filePromise = new Promise<void>((resolve, reject) => {
-      fileStream.on('data', (chunk) => {
-        bytesReceived += chunk.length;
-        if (bytesExpected > 0) {
-          const progress = (bytesReceived / bytesExpected) * 100;
-          const data = {
-            progress: progress.toFixed(2),
-            message: `Upload progress: ${progress.toFixed(2)}%`,
-          };
-          console.log('progress-upload', data);
-          writeEvents(req, data);
-        }
-      });
-
-      fileStream.pipe(writeStream);
-
-      writeStream.on('finish', () => {
-        files.push({
-          filepath: tempPath,
-          originalFilename: decodedFilename,
-          mimetype: mimeType,
-        });
-        resolve();
-      });
-
-      writeStream.on('error', (err) => {
-        reject(err);
-      });
-    });
-
-    filePromises.push(filePromise);
-  });
-
-  busboy.on('finish', async () => {
-    // 等待所有文件写入完成
-    try {
-      await Promise.all(filePromises);
-    } catch (err) {
-      logger.error(`File write error: ${err.message}`);
-      res.end(error(`File write error: ${err.message}`));
-      return;
-    }
-    const clearFiles = () => {
-      files.forEach((file) => {
-        if (file?.filepath && fs.existsSync(file.filepath)) {
-          fs.unlinkSync(file.filepath);
-        }
-      });
-    };
-
-    // 检查是否有文件上传
-    if (files.length === 0) {
-      res.end(error('files is required'));
-      return;
-    }
-
-    let { appKey, version, username, directory, description } = getKey(fields, ['appKey', 'version', 'username', 'directory', 'description']);
-    let uid = tokenUser.id;
-    if (username) {
-      const user = await User.getUserByToken(token);
-      const has = await user.hasUser(username, true);
-      if (!has) {
-        res.end(error('username is not found'));
-        clearFiles();
-        return;
-      }
-      const _user = await User.findOne({ where: { username } });
-      uid = _user?.id || '';
-    }
-    if (!appKey || !version) {
-      const config = await ConfigModel.getUploadConfig({ uid });
-      if (config) {
-        appKey = config.config?.data?.key || '';
-        version = config.config?.data?.version || '';
-      }
-    }
-    if (!appKey || !version) {
-      res.end(error('appKey or version is not found, please check the upload config.'));
-      clearFiles();
-      return;
-    }
-    const { code, message } = validateDirectory(directory);
-    if (code !== 200) {
-      res.end(error(message));
-      clearFiles();
-      return;
-    }
-    // 逐个处理每个上传的文件
-    const uploadedFiles = files;
-    logger.info(
-      'upload files',
-      uploadedFiles.map((item) => {
-        return pick(item, ['filepath', 'originalFilename']);
-      }),
-    );
-    const uploadResults = [];
-    for (let i = 0; i < uploadedFiles.length; i++) {
-      const file = uploadedFiles[i];
-      // @ts-ignore
-      const tempPath = file.filepath; // 文件上传时的临时路径
-      const relativePath = file.originalFilename; // 保留表单中上传的文件名 (包含文件夹结构)
-      // 比如 child2/b.txt
-      const minioPath = `${username || tokenUser.username}/${appKey}/${version}${directory ? `/${directory}` : ''}/${relativePath}`;
-      // 上传到 MinIO 并保留文件夹结构
-      const isHTML = relativePath.endsWith('.html');
-      const metadata: any = {};
-      if (share) {
-        metadata.share = 'public';
-      }
-      Object.assign(metadata, meta);
-      await oss.fPutObject(minioPath, tempPath, {
-        'Content-Type': getContentType(relativePath),
-        'app-source': 'user-app',
-        'Cache-Control': isHTML ? 'no-cache' : 'max-age=31536000, immutable', // 缓存一年
-        ...metadata,
-      });
-      uploadResults.push({
-        name: relativePath,
-        path: minioPath,
-      });
-      fs.unlinkSync(tempPath); // 删除临时文件
-    }
-    if (!noCheckAppFiles) {
-      const _data = { appKey, version, username, files: uploadResults, description, }
-      if (_data.description) {
-        delete _data.description;
-      }
-      // 受控
-      const r = await app.call({
-        path: 'app',
-        key: 'uploadFiles',
-        payload: {
-          token: token,
-          data: _data,
-        },
-      });
-      const data: any = {
-        code: r.code,
-        data: {
-          app: r.body,
-          upload: uploadResults,
-        },
-      };
-      if (r.message) {
-        data.message = r.message;
-      }
-      console.log('upload data', data);
-      res.writeHead(200, { 'Content-Type': 'application/json' });
-      res.end(JSON.stringify(data));
-    } else {
-      res.writeHead(200, { 'Content-Type': 'application/json' });
-      res.end(
-        JSON.stringify({
-          code: 200,
-          data: {
-            detect: [],
-            upload: uploadResults,
-          },
-        }),
-      );
-    }
-  });
-
-  pipeBusboy(req, res, busboy);
-});
--- a/src/routes-simple/resources/util.ts
+++ b/src/routes-simple/resources/util.ts
@@ -1,30 +0,0 @@
-/**
- * 校验directory是否合法, 合法返回200, 不合法返回500
- *
- * directory 不能以/开头，不能以/结尾。不能以.开头，不能以.结尾。
- * 把directory的/替换掉后，只能包含数字、字母、下划线、中划线
- * @param directory 目录
- * @returns
- */
-export const validateDirectory = (directory?: string) => {
-  // 对directory进行校验，不能以/开头，不能以/结尾。不能以.开头，不能以.结尾。
-  if (directory && (directory.startsWith('/') || directory.endsWith('/') || directory.startsWith('..') || directory.endsWith('..'))) {
-    return {
-      code: 500,
-      message: 'directory is invalid',
-    };
-  }
-  // 把directory的/替换掉后，只能包含数字、字母、下划线、中划线
-  // 可以包含.
-  let _directory = directory?.replace(/\//g, '');
-  if (_directory && !/^[a-zA-Z0-9_.-]+$/.test(_directory)) {
-    return {
-      code: 500,
-      message: 'directory is invalid, only number, letter, underline and hyphen are allowed',
-    };
-  }
-  return {
-    code: 200,
-    message: 'directory is valid',
-  };
-};
--- a/src/routes-simple/router.ts
+++ b/src/routes-simple/router.ts
@@ -1,8 +1,7 @@
 import { router } from '@/app.ts';
 import http from 'http';
 import { useContextKey } from '@kevisual/context';
-import { checkAuth, error } from './middleware/auth.ts';
-export { router, checkAuth, error };
+export { router, };

 /**
 * 事件客户端
--- a/src/routes/app-manager/list.ts
+++ b/src/routes/app-manager/list.ts
@@ -6,6 +6,7 @@ import { getUidByUsername, prefixFix } from './util.ts';
 import { deleteFiles, getMinioListAndSetToAppList } from '../file/index.ts';
 import { setExpire } from './revoke.ts';
 import { User } from '@/models/user.ts';
+import { callDetectAppVersion } from './export.ts';
 app
  .route({
    path: 'app',
@@ -43,7 +44,7 @@ app
    console.log('get app manager called');
    const tokenUser = ctx.state.tokenUser;
    const id = ctx.query.id;
-    const { key, version } = ctx.query?.data || {};
+    const { key, version, create = false } = ctx.query?.data || {};
    if (!id && (!key || !version)) {
      throw new CustomError('id is required');
    }
@@ -59,8 +60,27 @@ app
        },
      });
    }
+    if (!am && create) {
+      am = await AppListModel.create({
+        key,
+        version,
+        uid: tokenUser.id,
+        data: {},
+      });
+      const res = await app.run({ path: 'app', key: "detectVersionList", payload: { data: { appKey: key, version, username: tokenUser.username }, token: ctx.query.token } });
+      if (res.code !== 200) {
+        ctx.throw(res.message || 'detect version list error');
+      }
+      am = await AppListModel.findOne({
+        where: {
+          key,
+          version,
+          uid: tokenUser.id,
+        },
+      });
+    }
    if (!am) {
-      throw new CustomError('app not found');
+      ctx.throw('app not found');
    }
    console.log('get app', am.id, am.key, am.version);
    ctx.body = prefixFix(am, tokenUser.username);
@@ -239,7 +259,7 @@ app
  })
  .define(async (ctx) => {
    const tokenUser = ctx.state.tokenUser;
-    const { id, username, appKey, version } = ctx.query.data;
+    const { id, username, appKey, version, detect } = ctx.query.data;
    if (!id && !appKey) {
      throw new CustomError('id or appKey is required');
    }
@@ -249,22 +269,33 @@ app
    if (id) {
      appList = await AppListModel.findByPk(id);
      if (appList?.uid !== uid) {
-        throw new CustomError('no permission');
+        ctx.throw('no permission');
      }
    }
    if (!appList && appKey) {
      if (!version) {
-        throw new CustomError('version is required');
+        ctx.throw('version is required');
      }
      appList = await AppListModel.findOne({ where: { key: appKey, version, uid } });
    }
    if (!appList) {
-      throw new CustomError('app not found');
+      ctx.throw('app 未发现');
    }
+    if (detect) {
+      const appKey = appList.key;
+      const version = appList.version;
+      // 自动检测最新版本
+      const res = await callDetectAppVersion({ appKey, version, username: username || tokenUser.username }, ctx.query.token);
+      if (res.code !== 200) {
+        ctx.throw(res.message || '检测版本列表失败');
+      }
+      appList = await AppListModel.findByPk(appList.id);
+    }
+
    const files = appList.data.files || [];
    const am = await AppModel.findOne({ where: { key: appList.key, uid: uid } });
    if (!am) {
-      throw new CustomError('app not found');
+      ctx.throw('app 未发现');
    }
    await am.update({ data: { ...am.data, files }, version: appList.version });
    setExpire(appList.key, am.user);
@@ -366,7 +397,7 @@ app
      am = await AppModel.create({
        title: appKey,
        key: appKey,
-        version: version || '0.0.0',
+        version: version || '0.0.1',
        user: checkUsername,
        uid,
        data: { files: needAddFiles },
--- a/src/routes/config/check.ts
+++ b/src/routes/config/check.ts
@@ -1,8 +1,8 @@
-import { app } from '@/app.ts';
-import { ConfigModel } from './models/model.ts';
+import { eq, and, inArray } from 'drizzle-orm';
+import { app, db, schema } from '@/app.ts';
 import { oss } from '@/app.ts';
 import { ConfigOssService } from '@kevisual/oss/services';
-import { Op } from 'sequelize';
+import { nanoid } from 'nanoid';

 app
  .route({
@@ -20,14 +20,12 @@ app
      },
    });
    const { list, keys, keyEtagMap } = await configOss.getList();
-    const configList = await ConfigModel.findAll({
-      where: {
-        key: {
-          [Op.in]: keys,
-        },
-        uid: tokenUser.id,
-      },
-    });
+    const configList = await db.select()
+      .from(schema.kvConfig)
+      .where(and(
+        inArray(schema.kvConfig.key, keys),
+        eq(schema.kvConfig.uid, tokenUser.id)
+      ));
    const needUpdateList = list.filter((item) => {
      const key = item.key;
      const hash = keyEtagMap.get(key);
@@ -43,30 +41,33 @@ app
      const keyETag = keyEtagMap.get(key);
      const configData = keyDataMap.get(key);
      if (keyETag && configData) {
-        const [config, created] = await ConfigModel.findOrCreate({
-          where: {
-            key,
-            uid: tokenUser.id,
-          },
-          defaults: {
+        const existing = await db.select()
+          .from(schema.kvConfig)
+          .where(and(eq(schema.kvConfig.key, key), eq(schema.kvConfig.uid, tokenUser.id)))
+          .limit(1);
+        
+        let config;
+        if (existing.length === 0) {
+          const inserted = await db.insert(schema.kvConfig).values({
+            id: nanoid(),
            key,
            title: key,
            description: `从${key}:${keyETag} 同步而来`,
            uid: tokenUser.id,
            hash: keyETag,
            data: configData,
-          },
-        });
-        if (!created) {
-          await config.update(
-            {
+          }).returning();
+          config = inserted[0];
+        } else {
+          const updated = await db.update(schema.kvConfig)
+            .set({
              hash: keyETag,
              data: json,
-            },
-            {
-              fields: ['hash', 'data'],
-            },
-          );
+              updatedAt: new Date().toISOString(),
+            })
+            .where(eq(schema.kvConfig.id, existing[0].id))
+            .returning();
+          config = updated[0];
        }
        updateList.push(config);
      }
--- a/src/routes/config/config-key.ts
+++ b/src/routes/config/config-key.ts
@@ -1,7 +1,8 @@
-import { app } from '@/app.ts';
-import { ConfigModel } from './models/model.ts';
+import { eq, and } from 'drizzle-orm';
+import { app, db, schema } from '@/app.ts';
 import { User } from '@/models/user.ts';
 import { defaultKeys } from './models/default-keys.ts';
+import { nanoid } from 'nanoid';

 app
  .route({
@@ -27,19 +28,28 @@ app
    }
    const defaultConfig = defaultKeys.find((item) => item.key === configKey);

-    const [config, created] = await ConfigModel.findOrCreate({
-      where: {
-        key: configKey,
-        uid: tokenUser.id,
-      },
-      defaults: {
+    const existing = await db.select()
+      .from(schema.kvConfig)
+      .where(and(
+        eq(schema.kvConfig.key, configKey),
+        eq(schema.kvConfig.uid, tokenUser.id)
+      ))
+      .limit(1);
+    
+    let config;
+    if (existing.length === 0) {
+      const inserted = await db.insert(schema.kvConfig).values({
+        id: nanoid(),
        title: defaultConfig?.key,
        description: defaultConfig?.description || '',
        key: configKey,
        uid: tokenUser.id,
        data: defaultConfig?.data,
-      },
-    });
+      }).returning();
+      config = inserted[0];
+    } else {
+      config = existing[0];
+    }

    ctx.body = config;
  })
--- a/src/routes/config/list.ts
+++ b/src/routes/config/list.ts
@@ -1,8 +1,9 @@
-import { app } from '@/app.ts';
-import { ConfigModel } from './models/model.ts';
+import { eq, desc, and, inArray } from 'drizzle-orm';
+import { app, db, schema } from '@/app.ts';
 import { ShareConfigService } from './services/share.ts';
 import { oss } from '@/app.ts';
 import { ConfigOssService } from '@kevisual/oss/services';
+import { nanoid } from 'nanoid';

 app
  .route({
@@ -13,12 +14,10 @@ app
  })
  .define(async (ctx) => {
    const { id } = ctx.state.tokenUser;
-    const config = await ConfigModel.findAll({
-      where: {
-        uid: id,
-      },
-      order: [['updatedAt', 'DESC']],
-    });
+    const config = await db.select()
+      .from(schema.kvConfig)
+      .where(eq(schema.kvConfig.uid, id))
+      .orderBy(desc(schema.kvConfig.updatedAt));
    ctx.body = {
      list: config,
    };
@@ -36,9 +35,10 @@ app
    const tokernUser = ctx.state.tokenUser;
    const tuid = tokernUser.id;
    const { id, data, ...rest } = ctx.query?.data || {};
-    let config: ConfigModel;
+    let config: any;
    if (id) {
-      config = await ConfigModel.findByPk(id);
+      const configs = await db.select().from(schema.kvConfig).where(eq(schema.kvConfig.id, id)).limit(1);
+      config = configs[0];
      let keyIsChange = false;
      if (rest?.key) {
        keyIsChange = rest.key !== config?.key;
@@ -48,50 +48,57 @@ app
      }
      if (keyIsChange) {
        const key = rest.key;
-        const keyConfig = await ConfigModel.findOne({
-          where: {
-            key,
-            uid: tuid,
-          },
-        });
+        const keyConfigs = await db.select()
+          .from(schema.kvConfig)
+          .where(and(eq(schema.kvConfig.key, key), eq(schema.kvConfig.uid, tuid)))
+          .limit(1);
+        const keyConfig = keyConfigs[0];
        if (keyConfig && keyConfig.id !== id) {
          ctx.throw(403, 'key is already exists');
        }
      }
-      await config.update({
-        data: {
-          ...config.data,
-          ...data,
-        },
+      const updated = await db.update(schema.kvConfig)
+        .set({
+          data: data,
          ...rest,
-      });
-      if (config.data?.permission?.share === 'public') {
+          updatedAt: new Date().toISOString(),
+        })
+        .where(eq(schema.kvConfig.id, id))
+        .returning();
+      config = updated[0];
+      if ((config.data as any)?.permission?.share === 'public') {
        await ShareConfigService.expireShareConfig(config.key, tokernUser.username);
      }
      ctx.body = config;
    } else if (rest?.key) {
      // id 不存在，key存在，则属于更新，key不能重复
      const key = rest.key;
-      config = await ConfigModel.findOne({
-        where: {
-          key,
-          uid: tuid,
-        },
-      });
+      const configs = await db.select()
+        .from(schema.kvConfig)
+        .where(and(eq(schema.kvConfig.key, key), eq(schema.kvConfig.uid, tuid)))
+        .limit(1);
+      config = configs[0];
      if (config) {
-        await config.update({
-          data: { ...config.data, ...data },
+        const updated = await db.update(schema.kvConfig)
+          .set({
+            data: data,
            ...rest,
-        });
+            updatedAt: new Date().toISOString(),
+          })
+          .where(eq(schema.kvConfig.id, config.id))
+          .returning();
+        config = updated[0];
        ctx.body = config;
      } else {
        // 根据key创建一个配置
-        config = await ConfigModel.create({
+        const inserted = await db.insert(schema.kvConfig).values({
+          id: nanoid(),
          key,
          ...rest,
          data: data,
          uid: tuid,
-        });
+        }).returning();
+        config = inserted[0];
        ctx.body = config;
      }
    }
@@ -106,22 +113,25 @@ app
      const data = config.data;
      const hash = ossConfig.hash(data);
      if (config.hash !== hash) {
-        config.hash = hash;
-        await config.save({
-          fields: ['hash'],
-        });
+        await db.update(schema.kvConfig)
+          .set({
+            hash: hash,
+            updatedAt: new Date().toISOString(),
+          })
+          .where(eq(schema.kvConfig.id, config.id));
        await ossConfig.putJsonObject(key, data);
      }
    }
    if (config) return;

    // id和key不存在。创建一个新的配置, 而且没有id的
-    const newConfig = await ConfigModel.create({
+    const newConfig = await db.insert(schema.kvConfig).values({
+      id: nanoid(),
      ...rest,
      data: data,
      uid: tuid,
-    });
-    ctx.body = newConfig;
+    }).returning();
+    ctx.body = newConfig[0];
  })
  .addTo(app);

@@ -139,17 +149,17 @@ app
    if (!id && !key) {
      ctx.throw(400, 'id or key is required');
    }
-    let config: ConfigModel;
+    let config: any;
    if (id) {
-      config = await ConfigModel.findByPk(id);
+      const configs = await db.select().from(schema.kvConfig).where(eq(schema.kvConfig.id, id)).limit(1);
+      config = configs[0];
    }
    if (!config && key) {
-      config = await ConfigModel.findOne({
-        where: {
-          key,
-          uid: tuid,
-        },
-      });
+      const configs = await db.select()
+        .from(schema.kvConfig)
+        .where(and(eq(schema.kvConfig.key, key), eq(schema.kvConfig.uid, tuid)))
+        .limit(1);
+      config = configs[0];
    }
    if (!config) {
      ctx.throw(404, 'config not found');
@@ -174,12 +184,9 @@ app
    const tuid = tokernUser.id;
    const { id, key } = ctx.query?.data || {};
    if (id || key) {
-      const search: any = id ? { id } : { key };
-      const config = await ConfigModel.findOne({
-        where: {
-         ...search
-        },
-      });
+      const search: any = id ? eq(schema.kvConfig.id, id) : eq(schema.kvConfig.key, key);
+      const configs = await db.select().from(schema.kvConfig).where(search).limit(1);
+      const config = configs[0];
      if (config && config.uid === tuid) {
        const key = config.key;
        const ossConfig = ConfigOssService.fromBase({
@@ -193,7 +200,7 @@ app
            await ossConfig.deleteObject(key);
          } catch (e) { }
        }
-        await config.destroy();
+        await db.delete(schema.kvConfig).where(eq(schema.kvConfig.id, config.id));
      } else {
        ctx.throw(403, 'no permission');
      }
--- a/src/routes/config/models/model.ts
+++ b/src/routes/config/models/model.ts
@@ -1,7 +1,8 @@
 import { useContextKey } from '@kevisual/context';
-import { sequelize } from '../../../modules/sequelize.ts';
-import { DataTypes, Model } from 'sequelize';
 import { Permission } from '@kevisual/permission';
+import { eq, and } from 'drizzle-orm';
+import { db, schema } from '../../../app.ts';
+import { nanoid } from 'nanoid';

 export interface ConfigData {
  key?: string;
@@ -9,23 +10,24 @@ export interface ConfigData {
  permission?: Permission;
 }

-export type Config = Partial<InstanceType<typeof ConfigModel>>;
+export type Config = {
+  id: string;
+  title: string | null;
+  description: string | null;
+  tags: unknown;
+  key: string | null;
+  data: unknown;
+  uid: string | null;
+  hash: string | null;
+  createdAt: string;
+  updatedAt: string;
+  deletedAt: string | null;
+};

 /**
 * 用户配置
 */
-export class ConfigModel extends Model {
-  declare id: string;
-  declare title: string;
-  declare description: string;
-  declare tags: string[];
-  /**
-   * @important 配置key， 默认可以为空，如何设置了，必须要唯一。
-   */
-  declare key: string;
-  declare data: ConfigData; // files
-  declare uid: string;
-  declare hash: string;
+export class ConfigModel {
  /**
   * 获取用户配置
   * @param key 配置key
@@ -35,37 +37,60 @@ export class ConfigModel extends Model {
   * @returns 配置
   */
  static async getConfig(key: string, opts: { uid: string; defaultData?: any }) {
-    const [config, isNew] = await ConfigModel.findOrCreate({
-      where: { key, uid: opts.uid },
-      defaults: {
+    const existing = await db.select()
+      .from(schema.kvConfig)
+      .where(and(eq(schema.kvConfig.key, key), eq(schema.kvConfig.uid, opts.uid)))
+      .limit(1);
+    
+    if (existing.length > 0) {
+      return {
+        config: existing[0],
+        isNew: false,
+      };
+    }
+    
+    const inserted = await db.insert(schema.kvConfig).values({
+      id: nanoid(),
      key,
      title: key,
      uid: opts.uid,
      data: opts?.defaultData || {},
-      },
-    });
+    }).returning();
+    
    return {
-      config: config,
-      isNew,
+      config: inserted[0],
+      isNew: true,
    };
  }
+  
  static async setConfig(key: string, opts: { uid: string; data: any }) {
-    let config = await ConfigModel.findOne({
-      where: { key, uid: opts.uid },
-    });
-    if (config) {
-      config.data = { ...config.data, ...opts.data };
-      await config.save();
+    const existing = await db.select()
+      .from(schema.kvConfig)
+      .where(and(eq(schema.kvConfig.key, key), eq(schema.kvConfig.uid, opts.uid)))
+      .limit(1);
+    
+    if (existing.length > 0) {
+      const config = existing[0];
+      const updated = await db.update(schema.kvConfig)
+        .set({
+          data: { ...(config.data as any || {}), ...opts.data },
+          updatedAt: new Date().toISOString(),
+        })
+        .where(eq(schema.kvConfig.id, config.id))
+        .returning();
+      return updated[0];
    } else {
-      config = await ConfigModel.create({
+      const inserted = await db.insert(schema.kvConfig).values({
+        id: nanoid(),
        title: key,
        key,
        uid: opts.uid,
        data: opts.data,
-      });
+      }).returning();
+      return inserted[0];
    }
-    return config;
  }
+  
  /**
   * 获取上传配置
   * @param key 配置key
@@ -82,7 +107,7 @@ export class ConfigModel extends Model {
      uid: opts.uid,
      defaultData: defaultConfig,
    });
-    const data = config.config.data;
+    const data = config.config.data as any;
    const prefix = `/${data.key}/${data.version}`;
    return {
      config: config.config,
@@ -90,6 +115,7 @@ export class ConfigModel extends Model {
      prefix,
    };
  }
+  
  static async setUploadConfig(opts: { uid: string; data: { key?: string; version?: string } }) {
    const config = await ConfigModel.setConfig('upload.json', {
      uid: opts.uid,
@@ -98,52 +124,5 @@ export class ConfigModel extends Model {
    return config;
  }
 }
-ConfigModel.init(
-  {
-    id: {
-      type: DataTypes.UUID,
-      primaryKey: true,
-      defaultValue: DataTypes.UUIDV4,
-      comment: 'id',
-    },
-    title: {
-      type: DataTypes.TEXT,
-      defaultValue: '',
-    },
-    key: {
-      type: DataTypes.TEXT,
-      defaultValue: '',
-    },
-    description: {
-      type: DataTypes.TEXT,
-      defaultValue: '',
-    },
-    tags: {
-      type: DataTypes.JSONB,
-      defaultValue: [],
-    },
-    hash: {
-      type: DataTypes.TEXT,
-      defaultValue: '',
-    },
-    data: {
-      type: DataTypes.JSONB,
-      defaultValue: {},
-    },
-    uid: {
-      type: DataTypes.UUID,
-      allowNull: true,
-    },
-  },
-  {
-    sequelize,
-    tableName: 'kv_config',
-    paranoid: true,
-  },
-);
-
-// ConfigModel.sync({ alter: true, logging: false }).catch((e) => {
-//   console.error('ConfigModel sync', e);
-// });

 useContextKey('ConfigModel', () => ConfigModel);
--- a/src/routes/config/services/share.ts
+++ b/src/routes/config/services/share.ts
@@ -1,10 +1,10 @@
-import { ConfigModel, Config } from '../models/model.ts';
+import { Config } from '../models/model.ts';
 import { CustomError } from '@kevisual/router';
-import { redis } from '@/app.ts';
-import { User } from '@/models/user.ts';
+import { redis, db, schema } from '@/app.ts';
+import { eq, and } from 'drizzle-orm';
 import { UserPermission, UserPermissionOptions } from '@kevisual/permission';

-export class ShareConfigService extends ConfigModel {
+export class ShareConfigService {
  /**
   * 获取分享的配置
   * @param key 配置的key
@@ -22,26 +22,30 @@ export class ShareConfigService extends ConfigModel {
    }
    const owner = username;
    if (shareCacheConfig) {
-      const permission = new UserPermission({ permission: shareCacheConfig?.data?.permission, owner });
+      const permission = new UserPermission({ permission: (shareCacheConfig?.data as any)?.permission, owner });
      const result = permission.checkPermissionSuccess(options);
      if (!result.success) {
        throw new CustomError(403, 'no permission');
      }
      return shareCacheConfig;
    }
-    const user = await User.findOne({
-      where: { username },
-    });
+    const users = await db.select()
+      .from(schema.cfUser)
+      .where(eq(schema.cfUser.username, username))
+      .limit(1);
+    const user = users[0];
    if (!user) {
      throw new CustomError(404, 'user not found');
    }
-    const config = await ConfigModel.findOne({
-      where: { key, uid: user.id },
-    });
+    const configs = await db.select()
+      .from(schema.kvConfig)
+      .where(and(eq(schema.kvConfig.key, key), eq(schema.kvConfig.uid, user.id)))
+      .limit(1);
+    const config = configs[0];
    if (!config) {
      throw new CustomError(404, 'config not found');
    }
-    const permission = new UserPermission({ permission: config?.data?.permission, owner });
+    const permission = new UserPermission({ permission: (config?.data as any)?.permission, owner });
    const result = permission.checkPermissionSuccess(options);
    if (!result.success) {
      throw new CustomError(403, 'no permission');
--- a/src/routes/config/upload-config.ts
+++ b/src/routes/config/upload-config.ts
@@ -13,8 +13,9 @@ app
    const config = await ConfigModel.getUploadConfig({
      uid: tokenUser.id,
    });
-    const key = config?.config?.data?.key || '';
-    const version = config?.config?.data?.version || '';
+    const data: any = config?.config?.data || {};
+    const key = data.key || '';
+    const version = data.version || '';
    const username = tokenUser.username;
    const prefix = `${key}/${version}/`;
    ctx.body = {
@@ -35,7 +36,7 @@ app
  })
  .define(async (ctx) => {
    const { id } = ctx.state.tokenUser;
-    const data = ctx.query.data || {};
+    const data = ctx.query?.data || {};
    const { key, version } = data;
    if (!key && !version) {
      ctx.throw(400, 'key or version is required');
--- a/src/routes/index.ts
+++ b/src/routes/index.ts
@@ -10,6 +10,8 @@ import './config/index.ts';

 // import './file-listener/index.ts';

+import './mark/index.ts';
+
 import './light-code/index.ts';

 import './ai/index.ts';
--- a/src/routes/light-code/list.ts
+++ b/src/routes/light-code/list.ts
@@ -1,7 +1,8 @@
 import { eq, desc, and, like, or } from 'drizzle-orm';
-import { CustomError } from '@kevisual/router';
 import { app, db, schema } from '../../app.ts';
-
+import { CustomError } from '@kevisual/router';
+import { filter } from '@kevisual/js-filter'
+import { z } from 'zod';
 app
  .route({
    path: 'light-code',
@@ -9,10 +10,22 @@ app
    description: `获取轻代码列表,参数
  type: 代码类型light-code, ts`,
    middleware: ['auth'],
+    metadata: {
+      args: {
+        type: z.string().optional().describe('代码类型light-code, ts'),
+        search: z.string().optional().describe('搜索关键词，匹配标题和描述'),
+        filter: z
+          .string()
+          .optional()
+          .describe(
+            '过滤条件，SQL like格式字符串，例如：WHERE tags LIKE \'%tag1%\' AND tags LIKE \'%tag2%\'',
+          ),
+      }
+    }
  })
  .define(async (ctx) => {
    const tokenUser = ctx.state.tokenUser;
-    const { type, search } = ctx.query || {};
+    const { type, search, filter: filterQuery } = ctx.query || {};
    const conditions = [eq(schema.kvContainer.uid, tokenUser.id)];
    if (type) {
      conditions.push(eq(schema.kvContainer.type, type as string));
@@ -43,7 +56,12 @@ app
      .from(schema.kvContainer)
      .where(and(...conditions))
      .orderBy(desc(schema.kvContainer.updatedAt));
+    if (filterQuery) {
+      const filteredList = filter(list, filterQuery);
+      ctx.body = { list: filteredList }
+    } else {
      ctx.body = { list };
+    }
    return ctx;
  })
  .addTo(app);
@@ -140,7 +158,7 @@ app

 app
  .route({
-    path: 'container',
+    path: 'light-code',
    key: 'delete',
    middleware: ['auth'],
  })
--- a/src/routes/mark/index.ts
+++ b/src/routes/mark/index.ts
@@ -0,0 +1 @@
+import './list.ts';
--- a/src/routes/mark/list.ts
+++ b/src/routes/mark/list.ts
@@ -0,0 +1,308 @@
+import { eq, desc, and, like, or, count, sql } from 'drizzle-orm';
+import { app, db, schema } from '../../app.ts';
+import { MarkServices } from './services/mark.ts';
+import dayjs from 'dayjs';
+import { nanoid } from 'nanoid';
+
+app
+  .route({
+    path: 'mark',
+    key: 'list',
+    description: 'mark list.',
+    middleware: ['auth'],
+  })
+  .define(async (ctx) => {
+    const tokenUser = ctx.state.tokenUser;
+    ctx.body = await MarkServices.getList({
+      uid: tokenUser.id,
+      query: ctx.query,
+      queryType: 'simple',
+    });
+  })
+  .addTo(app);
+
+app
+  .route({
+    path: 'mark',
+    key: 'getVersion',
+    middleware: ['auth'],
+  })
+  .define(async (ctx) => {
+    const tokenUser = ctx.state.tokenUser;
+    const { id } = ctx.query;
+    if (id) {
+      const marks = await db.select().from(schema.microMark).where(eq(schema.microMark.id, id)).limit(1);
+      const markModel = marks[0];
+      if (!markModel) {
+        ctx.throw(404, 'mark not found');
+      }
+      if (markModel.uid !== tokenUser.id) {
+        ctx.throw(403, 'no permission');
+      }
+      ctx.body = {
+        version: Number(markModel.version),
+        updatedAt: markModel.updatedAt,
+        createdAt: markModel.createdAt,
+        id: markModel.id,
+      };
+    } else {
+      ctx.throw(400, 'id is required');
+      // const [markModel, created] = await MarkModel.findOrCreate({
+      //   where: {
+      //     uid: tokenUser.id,
+      //     puid: tokenUser.uid,
+      //     title: dayjs().format('YYYY-MM-DD'),
+      //   },
+      //   defaults: {
+      //     title: dayjs().format('YYYY-MM-DD'),
+      //     uid: tokenUser.id,
+      //     markType: 'wallnote',
+      //     tags: ['daily'],
+      //   },
+      // });
+      // ctx.body = {
+      //   version: Number(markModel.version),
+      //   updatedAt: markModel.updatedAt,
+      //   createdAt: markModel.createdAt,
+      //   id: markModel.id,
+      //   created: created,
+      // };
+    }
+  })
+  .addTo(app);
+
+app
+  .route({
+    path: 'mark',
+    key: 'get',
+    middleware: ['auth'],
+  })
+  .define(async (ctx) => {
+    const tokenUser = ctx.state.tokenUser;
+    const { id } = ctx.query;
+    if (id) {
+      const marks = await db.select().from(schema.microMark).where(eq(schema.microMark.id, id)).limit(1);
+      const markModel = marks[0];
+      if (!markModel) {
+        ctx.throw(404, 'mark not found');
+      }
+      if (markModel.uid !== tokenUser.id) {
+        ctx.throw(403, 'no permission');
+      }
+      ctx.body = markModel;
+    } else {
+      ctx.throw(400, 'id is required');
+      // id 不存在，获取当天的title为 日期的一条数据
+      // const [markModel, created] = await MarkModel.findOrCreate({
+      //   where: {
+      //     uid: tokenUser.id,
+      //     puid: tokenUser.uid,
+      //     title: dayjs().format('YYYY-MM-DD'),
+      //   },
+      //   defaults: {
+      //     title: dayjs().format('YYYY-MM-DD'),
+      //     uid: tokenUser.id,
+      //     markType: 'wallnote',
+      //     tags: ['daily'],
+      //     uname: tokenUser.username,
+      //     puid: tokenUser.uid,
+      //     version: 1,
+      //   },
+      // });
+      // ctx.body = markModel;
+    }
+  })
+  .addTo(app);
+
+app
+  .route({
+    path: 'mark',
+    key: 'update',
+    middleware: ['auth'],
+    isDebug: true,
+  })
+  .define(async (ctx) => {
+    const tokenUser = ctx.state.tokenUser;
+    const { id, createdAt, updatedAt, uid: _, puid: _2, uname: _3, data, ...rest } = ctx.query.data || {};
+    let markModel: any;
+    if (id) {
+      const marks = await db.select().from(schema.microMark).where(eq(schema.microMark.id, id)).limit(1);
+      markModel = marks[0];
+      if (!markModel) {
+        ctx.throw(404, 'mark not found');
+      }
+      if (markModel.uid !== tokenUser.id) {
+        ctx.throw(403, 'no permission');
+      }
+      const version = Number(markModel.version) + 1;
+      const updated = await db.update(schema.microMark)
+        .set({
+          ...rest,
+          data: {
+            ...(markModel.data as any || {}),
+            ...data,
+          },
+          version,
+          updatedAt: new Date().toISOString(),
+        })
+        .where(eq(schema.microMark.id, id))
+        .returning();
+      markModel = updated[0];
+    } else {
+      const inserted = await db.insert(schema.microMark).values({
+        id: nanoid(),
+        data: data || {},
+        ...rest,
+        uname: tokenUser.username,
+        uid: tokenUser.id,
+        puid: tokenUser.uid,
+      }).returning();
+      markModel = inserted[0];
+    }
+    ctx.body = markModel;
+  })
+  .addTo(app);
+app
+  .route({
+    path: 'mark',
+    key: 'updateNode',
+    middleware: ['auth'],
+  })
+  .define(async (ctx) => {
+    const tokenUser = ctx.state.tokenUser;
+    const operate = ctx.query.operate || 'update';
+    const { id, node } = ctx.query.data || {};
+    const marks = await db.select().from(schema.microMark).where(eq(schema.microMark.id, id)).limit(1);
+    const markModel = marks[0];
+    if (!markModel) {
+      ctx.throw(404, 'mark not found');
+    }
+    if (markModel.uid !== tokenUser.id) {
+      ctx.throw(403, 'no permission');
+    }
+    // Update JSON node logic with Drizzle
+    const currentData = markModel.data as any || {};
+    const nodes = currentData.nodes || [];
+    const nodeIndex = nodes.findIndex((n: any) => n.id === node.id);
+    
+    let updatedNodes;
+    if (operate === 'delete') {
+      updatedNodes = nodes.filter((n: any) => n.id !== node.id);
+    } else if (nodeIndex >= 0) {
+      updatedNodes = [...nodes];
+      updatedNodes[nodeIndex] = { ...nodes[nodeIndex], ...node };
+    } else {
+      updatedNodes = [...nodes, node];
+    }
+    
+    const version = Number(markModel.version) + 1;
+    const updated = await db.update(schema.microMark)
+      .set({
+        data: { ...currentData, nodes: updatedNodes },
+        version,
+        updatedAt: new Date().toISOString(),
+      })
+      .where(eq(schema.microMark.id, id))
+      .returning();
+    ctx.body = updated[0];
+  })
+  .addTo(app);
+app
+  .route({
+    path: 'mark',
+    key: 'updateNodes',
+    middleware: ['auth'],
+  })
+  .define(async (ctx) => {
+    const tokenUser = ctx.state.tokenUser;
+    const { id, nodeOperateList } = ctx.query.data || {};
+    const marks = await db.select().from(schema.microMark).where(eq(schema.microMark.id, id)).limit(1);
+    const markModel = marks[0];
+    if (!markModel) {
+      ctx.throw(404, 'mark not found');
+    }
+    if (markModel.uid !== tokenUser.id) {
+      ctx.throw(403, 'no permission');
+    }
+    if (!nodeOperateList || !Array.isArray(nodeOperateList) || nodeOperateList.length === 0) {
+      ctx.throw(400, 'nodeOperateList is required');
+    }
+    if (nodeOperateList.some((item: any) => !item.node)) {
+      ctx.throw(400, 'nodeOperateList node is required');
+    }
+    
+    // Update multiple JSON nodes logic with Drizzle
+    const currentData = markModel.data as any || {};
+    let nodes = currentData.nodes || [];
+    
+    for (const item of nodeOperateList) {
+      const { node, operate = 'update' } = item;
+      const nodeIndex = nodes.findIndex((n: any) => n.id === node.id);
+      
+      if (operate === 'delete') {
+        nodes = nodes.filter((n: any) => n.id !== node.id);
+      } else if (nodeIndex >= 0) {
+        nodes[nodeIndex] = { ...nodes[nodeIndex], ...node };
+      } else {
+        nodes.push(node);
+      }
+    }
+    
+    const version = Number(markModel.version) + 1;
+    const updated = await db.update(schema.microMark)
+      .set({
+        data: { ...currentData, nodes },
+        version,
+        updatedAt: new Date().toISOString(),
+      })
+      .where(eq(schema.microMark.id, id))
+      .returning();
+    ctx.body = updated[0];
+  })
+  .addTo(app);
+
+app
+  .route({
+    path: 'mark',
+    key: 'delete',
+    middleware: ['auth'],
+  })
+  .define(async (ctx) => {
+    const tokenUser = ctx.state.tokenUser;
+    const { id } = ctx.query;
+    const marks = await db.select().from(schema.microMark).where(eq(schema.microMark.id, id)).limit(1);
+    const markModel = marks[0];
+    if (!markModel) {
+      ctx.throw(404, 'mark not found');
+    }
+    if (markModel.uid !== tokenUser.id) {
+      ctx.throw(403, 'no permission');
+    }
+    await db.delete(schema.microMark).where(eq(schema.microMark.id, id));
+    ctx.body = markModel;
+  })
+  .addTo(app);
+
+app
+  .route({ path: 'mark', key: 'getMenu', description: '获取菜单', middleware: ['auth'] })
+  .define(async (ctx) => {
+    const tokenUser = ctx.state.tokenUser;
+    const [rows, totalResult] = await Promise.all([
+      db.select({
+        id: schema.microMark.id,
+        title: schema.microMark.title,
+        summary: schema.microMark.summary,
+        tags: schema.microMark.tags,
+        thumbnail: schema.microMark.thumbnail,
+        link: schema.microMark.link,
+        createdAt: schema.microMark.createdAt,
+        updatedAt: schema.microMark.updatedAt,
+      }).from(schema.microMark).where(eq(schema.microMark.uid, tokenUser.id)),
+      db.select({ count: count() }).from(schema.microMark).where(eq(schema.microMark.uid, tokenUser.id))
+    ]);
+    ctx.body = {
+      list: rows,
+      total: totalResult[0]?.count || 0,
+    };
+  })
+  .addTo(app);
--- a/src/routes/mark/mark-model.ts
+++ b/src/routes/mark/mark-model.ts
@@ -0,0 +1,327 @@
+import { useContextKey } from '@kevisual/context';
+import { nanoid, customAlphabet } from 'nanoid';
+import { DataTypes, Model, ModelAttributes } from 'sequelize';
+import type { Sequelize } from 'sequelize';
+export const random = customAlphabet('1234567890abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ');
+export type Mark = Partial<InstanceType<typeof MarkModel>>;
+export type MarkData = {
+  md?: string; // markdown
+  mdList?: string[]; // markdown list
+  type?: string; // 类型 markdown | json | html | image | video | audio | code | link | file
+  data?: any;
+  key?: string; // 文件的名称, 唯一
+  push?: boolean; // 是否推送到elasticsearch
+  pushTime?: Date; // 推送时间
+  summary?: string; // 摘要
+  nodes?: MarkDataNode[]; // 节点
+  [key: string]: any;
+};
+export type MarkFile = {
+  id: string;
+  name: string;
+  url: string;
+  size: number;
+  type: 'self' | 'data' | 'generate'; // generate为生成文件
+  query: string; // 'data.nodes[id].content';
+  hash: string;
+  fileKey: string; // 文件的名称, 唯一
+};
+export type MarkDataNode = {
+  id?: string;
+  [key: string]: any;
+};
+export type MarkConfig = {
+  [key: string]: any;
+};
+export type MarkAuth = {
+  [key: string]: any;
+};
+/**
+ * 隐秘内容
+ * auth
+ * config
+ *
+ */
+export class MarkModel extends Model {
+  declare id: string;
+  declare title: string; // 标题，可以ai生成
+  declare description: string; // 描述，可以ai生成
+  declare cover: string; // 封面，可以ai生成
+  declare thumbnail: string; // 缩略图
+  declare key: string; // 文件路径
+  declare markType: string; // markdown | json | html | image | video | audio | code | link | file
+  declare link: string; // 访问链接
+  declare tags: string[]; // 标签
+  declare summary: string; // 摘要， description的简化版
+  declare data: MarkData; // 数据
+
+  declare uid: string; // 操作用户的id
+  declare puid: string; // 父级用户的id, 真实用户
+  declare config: MarkConfig; // mark属于一定不会暴露的内容。
+
+  declare fileList: MarkFile[]; // 文件管理
+  declare uname: string; // 用户的名称, 或者着别名
+
+  declare markedAt: Date; // 标记时间
+  declare createdAt: Date;
+  declare updatedAt: Date;
+  declare version: number;
+  /**
+   * 加锁更新data中的node的节点，通过node的id
+   * @param param0
+   */
+  static async updateJsonNode(id: string, node: MarkDataNode, opts?: { operate?: 'update' | 'delete'; Model?: any; sequelize?: Sequelize }) {
+    const sequelize = opts?.sequelize || (await useContextKey('sequelize'));
+    const transaction = await sequelize.transaction(); // 开启事务
+    const operate = opts.operate || 'update';
+    const isUpdate = operate === 'update';
+    const Model = opts.Model || MarkModel;
+    try {
+      // 1. 获取当前的 JSONB 字段值（加锁）
+      const mark = await Model.findByPk(id, {
+        transaction,
+        lock: transaction.LOCK.UPDATE, // 加锁，防止其他事务同时修改
+      });
+      if (!mark) {
+        throw new Error('Mark not found');
+      }
+      // 2. 修改特定的数组元素
+      const data = mark.data as MarkData;
+      const items = data.nodes;
+      if (!node.id) {
+        node.id = random(12);
+      }
+
+      // 找到要更新的元素
+      const itemIndex = items.findIndex((item) => item.id === node.id);
+      if (itemIndex === -1) {
+        isUpdate && items.push(node);
+      } else {
+        if (isUpdate) {
+          items[itemIndex] = node;
+        } else {
+          items.splice(itemIndex, 1);
+        }
+      }
+      const version = Number(mark.version) + 1;
+      // 4. 更新 JSONB 字段
+      const result = await mark.update(
+        {
+          data: {
+            ...data,
+            nodes: items,
+          },
+          version,
+        },
+        { transaction },
+      );
+
+      await transaction.commit();
+      return result;
+    } catch (error) {
+      await transaction.rollback();
+      throw error;
+    }
+  }
+  static async updateJsonNodes(id: string, nodes: { node: MarkDataNode; operate?: 'update' | 'delete' }[], opts?: { Model?: any; sequelize?: Sequelize }) {
+    const sequelize = opts?.sequelize || (await useContextKey('sequelize'));
+    const transaction = await sequelize.transaction(); // 开启事务
+    const Model = opts?.Model || MarkModel;
+    try {
+      const mark = await Model.findByPk(id, {
+        transaction,
+        lock: transaction.LOCK.UPDATE, // 加锁，防止其他事务同时修改
+      });
+      if (!mark) {
+        throw new Error('Mark not found');
+      }
+      const data = mark.data as MarkData;
+      const _nodes = data.nodes || [];
+      // 过滤不在nodes中的节点
+      const blankNodes = nodes.filter((node) => !_nodes.find((n) => n.id === node.node.id)).map((node) => node.node);
+      // 更新或删除节点
+      const newNodes = _nodes
+        .map((node) => {
+          const nodeOperate = nodes.find((n) => n.node.id === node.id);
+          if (nodeOperate) {
+            if (nodeOperate.operate === 'delete') {
+              return null;
+            }
+            return nodeOperate.node;
+          }
+          return node;
+        })
+        .filter((node) => node !== null);
+      const version = Number(mark.version) + 1;
+      const result = await mark.update(
+        {
+          data: {
+            ...data,
+            nodes: [...blankNodes, ...newNodes],
+          },
+          version,
+        },
+        { transaction },
+      );
+      await transaction.commit();
+      return result;
+    } catch (error) {
+      await transaction.rollback();
+      throw error;
+    }
+  }
+  static async updateData(id: string, data: MarkData, opts: { Model?: any; sequelize?: Sequelize }) {
+    const sequelize = opts.sequelize || (await useContextKey('sequelize'));
+    const transaction = await sequelize.transaction(); // 开启事务
+    const Model = opts.Model || MarkModel;
+    const mark = await Model.findByPk(id, {
+      transaction,
+      lock: transaction.LOCK.UPDATE, // 加锁，防止其他事务同时修改
+    });
+    if (!mark) {
+      throw new Error('Mark not found');
+    }
+    const version = Number(mark.version) + 1;
+    const result = await mark.update(
+      {
+        ...mark.data,
+        ...data,
+        data: {
+          ...mark.data,
+          ...data,
+        },
+        version,
+      },
+      { transaction },
+    );
+    await transaction.commit();
+    return result;
+  }
+  static async createNew(data: any, opts: { Model?: any; sequelize?: Sequelize }) {
+    const sequelize = opts.sequelize || (await useContextKey('sequelize'));
+    const transaction = await sequelize.transaction(); // 开启事务
+    const Model = opts.Model || MarkModel;
+    const result = await Model.create({ ...data, version: 1 }, { transaction });
+    await transaction.commit();
+    return result;
+  }
+}
+export type MarkInitOpts<T = any> = {
+  tableName: string;
+  sequelize?: Sequelize;
+  callInit?: (attribute: ModelAttributes) => ModelAttributes;
+  Model?: T extends typeof MarkModel ? T : typeof MarkModel;
+};
+export type Opts = {
+  sync?: boolean;
+  alter?: boolean;
+  logging?: boolean | ((...args: any) => any);
+  force?: boolean;
+};
+export const MarkMInit = async <T = any>(opts: MarkInitOpts<T>, sync?: Opts) => {
+  const sequelize = await useContextKey('sequelize');
+  opts.sequelize = opts.sequelize || sequelize;
+  const { callInit, Model, ...optsRest } = opts;
+  const modelAttribute = {
+    id: {
+      type: DataTypes.UUID,
+      primaryKey: true,
+      defaultValue: DataTypes.UUIDV4,
+      comment: 'id',
+    },
+    title: {
+      type: DataTypes.TEXT,
+      defaultValue: '',
+    },
+    key: {
+      type: DataTypes.TEXT, // 对应的minio的文件路径
+      defaultValue: '',
+    },
+    markType: {
+      type: DataTypes.TEXT,
+      defaultValue: 'md', // markdown | json | html | image | video | audio | code | link | file
+      comment: '类型',
+    },
+    description: {
+      type: DataTypes.TEXT,
+      defaultValue: '',
+    },
+    cover: {
+      type: DataTypes.TEXT,
+      defaultValue: '',
+      comment: '封面',
+    },
+    thumbnail: {
+      type: DataTypes.TEXT,
+      defaultValue: '',
+      comment: '缩略图',
+    },
+    link: {
+      type: DataTypes.TEXT,
+      defaultValue: '',
+      comment: '链接',
+    },
+    tags: {
+      type: DataTypes.JSONB,
+      defaultValue: [],
+    },
+    summary: {
+      type: DataTypes.TEXT,
+      defaultValue: '',
+      comment: '摘要',
+    },
+    config: {
+      type: DataTypes.JSONB,
+      defaultValue: {},
+    },
+    data: {
+      type: DataTypes.JSONB,
+      defaultValue: {},
+    },
+    fileList: {
+      type: DataTypes.JSONB,
+      defaultValue: [],
+    },
+    uname: {
+      type: DataTypes.STRING,
+      defaultValue: '',
+      comment: '用户的名称, 更新后的用户的名称',
+    },
+    version: {
+      type: DataTypes.INTEGER, // 更新刷新版本，多人协作
+      defaultValue: 1,
+    },
+    markedAt: {
+      type: DataTypes.DATE,
+      allowNull: true,
+      comment: '标记时间',
+    },
+    uid: {
+      type: DataTypes.UUID,
+      allowNull: true,
+    },
+    puid: {
+      type: DataTypes.UUID,
+      allowNull: true,
+    },
+  };
+  const InitModel = Model || MarkModel;
+  InitModel.init(callInit ? callInit(modelAttribute) : modelAttribute, {
+    sequelize,
+    paranoid: true,
+    ...optsRest,
+  });
+  if (sync && sync.sync) {
+    const { sync: _, ...rest } = sync;
+    MarkModel.sync({ alter: true, logging: false, ...rest }).catch((e) => {
+      console.error('MarkModel sync', e);
+    });
+  }
+};
+
+export const markModelInit = MarkMInit;
+
+export const syncMarkModel = async (sync?: Opts, tableName = 'micro_mark') => {
+  const sequelize = await useContextKey('sequelize');
+  await MarkMInit({ sequelize, tableName }, sync);
+};
--- a/src/routes/mark/model.ts
+++ b/src/routes/mark/model.ts
@@ -0,0 +1,5 @@
+export * from '@kevisual/code-center-module/src/mark/mark-model.ts';
+import { markModelInit, MarkModel, syncMarkModel } from '@kevisual/code-center-module/src/mark/mark-model.ts';
+export { markModelInit, MarkModel };
+
+syncMarkModel({ sync: true, alter: true, logging: false });
--- a/src/routes/mark/services/mark.ts
+++ b/src/routes/mark/services/mark.ts
@@ -0,0 +1,85 @@
+import { eq, desc, asc, and, like, or, count } from 'drizzle-orm';
+import { app, db, schema } from '../../../app.ts';
+
+export class MarkServices {
+  static getList = async (opts: {
+    /** 查询用户的 */
+    uid?: string;
+    query?: {
+      page?: number;
+      pageSize?: number;
+      search?: string;
+      markType?: string;
+      sort?: string;
+    };
+    /**
+     * 查询类型
+     * simple: 简单查询 默认
+     */
+    queryType?: string;
+  }) => {
+    const { uid, query = {} } = opts;
+    const { page = 1, pageSize = 999, search, sort = 'DESC' } = query;
+    
+    const conditions = [];
+    if (uid) {
+      conditions.push(eq(schema.microMark.uid, uid));
+    }
+    if (search) {
+      conditions.push(
+        or(
+          like(schema.microMark.title, `%${search}%`),
+          like(schema.microMark.summary, `%${search}%`)
+        )
+      );
+    }
+    if (opts.query?.markType) {
+      conditions.push(eq(schema.microMark.markType, opts.query.markType));
+    }
+    
+    const whereClause = conditions.length > 0 ? and(...conditions) : undefined;
+    
+    const queryType = opts.queryType || 'simple';
+    let selectFields: any = {};
+    
+    if (queryType === 'simple') {
+      // Exclude data, config, cover, description
+      selectFields = {
+        id: schema.microMark.id,
+        title: schema.microMark.title,
+        tags: schema.microMark.tags,
+        uname: schema.microMark.uname,
+        uid: schema.microMark.uid,
+        createdAt: schema.microMark.createdAt,
+        updatedAt: schema.microMark.updatedAt,
+        thumbnail: schema.microMark.thumbnail,
+        link: schema.microMark.link,
+        summary: schema.microMark.summary,
+        markType: schema.microMark.markType,
+        puid: schema.microMark.puid,
+        deletedAt: schema.microMark.deletedAt,
+        version: schema.microMark.version,
+        fileList: schema.microMark.fileList,
+        key: schema.microMark.key,
+      };
+    }
+    
+    const orderByField = sort === 'ASC' ? asc(schema.microMark.updatedAt) : desc(schema.microMark.updatedAt);
+    
+    const [rows, totalResult] = await Promise.all([
+      queryType === 'simple'
+        ? db.select(selectFields).from(schema.microMark).where(whereClause).orderBy(orderByField).limit(pageSize).offset((page - 1) * pageSize)
+        : db.select().from(schema.microMark).where(whereClause).orderBy(orderByField).limit(pageSize).offset((page - 1) * pageSize),
+      db.select({ count: count() }).from(schema.microMark).where(whereClause)
+    ]);
+    
+    return {
+      pagination: {
+        current: page,
+        pageSize,
+        total: totalResult[0]?.count || 0,
+      },
+      list: rows,
+    };
+  };
+}
--- a/src/routes/user/me.ts
+++ b/src/routes/user/me.ts
@@ -153,7 +153,9 @@ app
      browser: someInfo['user-agent'],
      host: someInfo.host,
    });
-    createCookie(token, ctx);
+    createCookie({
+      token: token.accessToken
+    }, ctx);
    ctx.body = token;
  })
  .addTo(app);
@@ -259,7 +261,10 @@ app
      const refreshToken = accessUser.oauthExpand?.refreshToken;
      if (refreshToken) {
        const result = await User.oauth.refreshToken(refreshToken);
-        createCookie(result, ctx);
+        createCookie({
+          token: result.accessToken
+        }, ctx);
+
        ctx.body = result;
        return;
      } else if (accessUser) {
@@ -268,7 +273,9 @@ app
          ...accessUser.oauthExpand,
          hasRefreshToken: true,
        });
-        createCookie(result, ctx);
+        createCookie({
+          token: result.accessToken
+        }, ctx);
        ctx.body = result;
        return;
      }
@@ -323,13 +330,17 @@ app
    if (orgsList.includes(username)) {
      if (tokenUsername === username) {
        const result = await User.oauth.resetToken(token);
-        createCookie(result, ctx);
+        createCookie({
+          token: result.accessToken,
+        }, ctx);
        await User.oauth.delToken(token);
        ctx.body = result;
      } else {
        const user = await User.findOne({ where: { username } });
        const result = await user.createToken(userId, 'default');
-        createCookie(result, ctx);
+        createCookie({
+          token: result.accessToken,
+        }, ctx);
        ctx.body = result;
      }
    } else {
@@ -352,7 +363,9 @@ app
      const result = await User.oauth.refreshToken(refreshToken);
      if (result) {
        console.log('refreshToken result', result);
-        createCookie(result, ctx);
+        createCookie({
+          token: result.accessToken,
+        }, ctx);
        ctx.body = result;
      } else {
        ctx.throw(500, 'Refresh Token Failed, please login again');
--- a/src/routes/user/web-login.ts
+++ b/src/routes/user/web-login.ts
@@ -109,7 +109,9 @@ app
      const token = JSON.parse(data);
      if (token.accessToken) {
        ctx.body = token;
-        createCookie(token, ctx);
+        createCookie({
+          token: token.accessToken,
+        }, ctx);
      } else {
        ctx.throw(500, 'Checked error Failed, login failed, please login again');
      }
Author	SHA1	Message	Date
abearxiong	266b7b33de	Refactor config management to use Drizzle ORM - Replaced Sequelize with Drizzle ORM in config-related routes and models. - Updated database queries to use Drizzle's syntax for selecting, inserting, updating, and deleting configurations. - Removed the ConfigModel class and replaced it with direct database interactions. - Introduced nanoid for generating unique IDs for new configurations. - Added new routes for managing marks, including CRUD operations and versioning. - Implemented transaction handling for critical operations in the MarkModel. - Enhanced error handling and validation in routes.	2026-02-05 16:31:11 +08:00
abearxiong	5200cf4c38	修复用户应用键的分隔符，从 '-' 更改为 '--'，以保持一致性并优化 WebSocket 连接管理	2026-02-05 14:08:45 +08:00
abearxiong	bf436f05e3	优化 WebSocket 连接管理，确保在注册新连接时关闭旧连接	2026-02-05 13:38:55 +08:00
abearxiong	bd7525efb0	添加心跳机制以保持 WebSocket 连接，优化连接关闭时的资源清理	2026-02-05 04:58:28 +08:00
abearxiong	f616045625	优化用户代理逻辑，移除非管理员用户的敏感数据	2026-02-05 04:50:54 +08:00
abearxiong	a51d04341e	添加 @kevisual/api 依赖，更新 WebSocket 消息发送逻辑，支持上下文参数	2026-02-05 04:06:34 +08:00
abearxiong	7bbefd8a4a	添加自动检测最新版本功能，更新应用信息时支持检测参数	2026-02-05 01:07:44 +08:00
abearxiong	db5c5a89b3	clear	2026-02-04 19:48:02 +08:00
abearxiong	86d4c7f75b	移除不再支持的文件扩展名 '.mjs' 从文本内容类型列表中	2026-02-04 19:45:01 +08:00
abearxiong	cbc9b54284	update	2026-02-04 03:08:53 +08:00
abearxiong	b1d3ca241c	优化 token 处理逻辑，统一过期时间字段命名	2026-02-03 17:09:09 +08:00
abearxiong	158dd9e85c	Refactor AI proxy error handling and remove deprecated upload and event routes - Updated `getAiProxy` function to return a JSON response for missing objects when the user is the owner. - Removed the `upload.ts`, `event.ts`, and related middleware files to streamline the codebase. - Cleaned up `handle-request.ts` and `index.ts` by removing unused imports and routes. - Deleted chunk upload handling and related utility functions to simplify resource management. - Enhanced app manager list functionality to support app creation if not found.	2026-02-02 18:06:31 +08:00
abearxiong	82e3392b36	优化 token 处理逻辑，统一 createCookie 调用格式，返回 token 过期时间	2026-02-02 17:02:20 +08:00
abearxiong	a0f0f65d20	update	2026-02-01 19:26:44 +08:00