fix: add missing ip_preference column to PostgreSQL tunnel table

2026-09-28 07:36:38 +08:00 · 2026-02-15 16:25:51 +00:00
282 changed files with 10680 additions and 76262 deletions
@@ -1,84 +0,0 @@
-{
-  "hooks": {
-    "PostToolUse": [
-      {
-        "matcher": "Task",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "entire hooks claude-code post-task"
-          }
-        ]
-      },
-      {
-        "matcher": "TodoWrite",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "entire hooks claude-code post-todo"
-          }
-        ]
-      }
-    ],
-    "PreToolUse": [
-      {
-        "matcher": "Task",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "entire hooks claude-code pre-task"
-          }
-        ]
-      }
-    ],
-    "SessionEnd": [
-      {
-        "matcher": "",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "entire hooks claude-code session-end"
-          }
-        ]
-      }
-    ],
-    "SessionStart": [
-      {
-        "matcher": "",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "entire hooks claude-code session-start"
-          }
-        ]
-      }
-    ],
-    "Stop": [
-      {
-        "matcher": "",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "entire hooks claude-code stop"
-          }
-        ]
-      }
-    ],
-    "UserPromptSubmit": [
-      {
-        "matcher": "",
-        "hooks": [
-          {
-            "type": "command",
-            "command": "entire hooks claude-code user-prompt-submit"
-          }
-        ]
-      }
-    ]
-  },
-  "permissions": {
-    "deny": [
-      "Read(./.entire/metadata/**)"
-    ]
-  }
-}
@@ -1,24 +0,0 @@
-# Session Context
-
-Session ID: ses_34dfc44d5ffedfgo4G9wPONyXC
-Commit Message: 在agent.md里规定，每次计划都必须写一个计划文档，md格式，按序号增加和以计划的总结命名，每次完成一个任务做好标记
-
-## Prompts
-
-### Prompt 1
-
-在agent.md里规定，每次计划都必须写一个计划文档，md格式，按序号增加和以计划的总结命名，每次完成一个任务做好标记
-
-## Summary
-
-已按你的要求更新完成。
-
-我在 `AGENTS.md` 里新增了 `## PLAN DOCUMENT RULE` 章节，内容包括：
-
- 每次新实现计划都必须有独立 Markdown 计划文档  
- 计划文档统一放在 `plans/` 目录  
- 文件名采用递增序号 + 计划摘要：`NNN-<plan-summary>.md`  
- 序号必须每次 +1  
- 文档内使用任务清单，并在每个任务完成后立即打勾标记  
-
-修改位置：`AGENTS.md`
@@ -1 +0,0 @@
-在agent.md里规定，每次计划都必须写一个计划文档，md格式，按序号增加和以计划的总结命名，每次完成一个任务做好标记
@@ -1,11 +0,0 @@
-已按你的要求更新完成。
-
-我在 `AGENTS.md` 里新增了 `## PLAN DOCUMENT RULE` 章节，内容包括：
-
- 每次新实现计划都必须有独立 Markdown 计划文档  
- 计划文档统一放在 `plans/` 目录  
- 文件名采用递增序号 + 计划摘要：`NNN-<plan-summary>.md`  
- 序号必须每次 +1  
- 文档内使用任务清单，并在每个任务完成后立即打勾标记  
-
-修改位置：`AGENTS.md`
@@ -1,71 +0,0 @@
-# Session Context
-
-Session ID: ses_34dfda207ffeiBV2rCgJW708ip
-Commit Message: 配置下发也没兼容，请全量检查一下，哪些功能需要一起改造
-
-## Prompts
-
-### Prompt 1
-
-211 任务的没有完全完成1. 选择IP后诊断还会诊断默认IP
-2. 选择隧道出口IP后，入口还是会链接默认IP，没有链接选择的IP
-请分析后制定修复计划
-
-### Prompt 2
-
-配置下发也没兼容，请全量检查一下，哪些功能需要一起改造
-
-## Summary
-
-你提得很对，我按“配置下发全链路”重新过了一遍（只读分析）。结论是：**需要一起改造的不是一个点，而是“诊断链路 + 重部署链路 + 回归测试链路”**。
-
-目前状态可以分成三类：
-
- **已兼容（创建/更新时下发）**
-  - 隧道创建/更新时，`connectIp` 已进入运行时下发选择逻辑（`selectTunnelDialHost`）。
-  - 本地/联邦 runtime apply 都会吃 `target.ConnectIP`（前提是 state 里有值）。
-  - 参考：`go-backend/internal/http/handler/mutations.go:2588`, `go-backend/internal/http/handler/mutations.go:2348`
-
- **未兼容（你反馈的核心问题）**
-  - 诊断链路未传 `connectIp`，导致总走默认IP。
-  - 参考：`go-backend/internal/http/handler/control_plane.go:75`, `go-backend/internal/http/handler/control_plane.go:1102`
-
- **半兼容（配置重建时丢字段）**
-  - 重部署时从 DB 重建 runtime state，**没把 `ConnectIP` 带回去**，所以 redeploy 后会回退默认IP。
-  - 参考：`go-backend/internal/http/handler/mutations.go:883`, `go-backend/internal/http/handler/mutations.go:897`
-
---
-
-**需要一起改造的功能范围（建议一次性做完）**
-
- `诊断（非流式 + 流式）`
-  - 隧道诊断、转发诊断都要改（共用 `prepare*Diagnosis` + `appendChainHopDiagnosis`）。
-  - 流式 start 预览项也要改，否则 UI 一开始仍显示默认IP。
-  - 目标文件：`go-backend/internal/http/handler/control_plane.go`, `go-backend/internal/http/handler/diagnosis_stream.go`
-
- `配置下发（重部署路径）`
-  - 单条重部署、批量重部署都依赖 `reconstructTunnelState`，必须补 `ConnectIP` 回填。
-  - 目标文件：`go-backend/internal/http/handler/mutations.go`
-
- `联邦节点运行时下发一致性`
-  - 逻辑本身已支持 `ConnectIP`，但受上一步 state 丢字段影响；修复后自动恢复一致。
-  - 重点验证：remote middle hop `ApplyRole.Targets` 的 Host 选取。
-
- `回归测试`
-  - 新增诊断用例：选了 `connectIp` 后，`targetIp` 必须是选中值（tunnel/forward + stream start/item）。
-  - 新增重部署用例：redeploy 后仍使用 `connectIp`，不回退默认IP。
-  - 目标文件建议：`go-backend/tests/contract/diagnosis_contract_test.go`，补 handler 级或 contract 级 redeploy 用例。
-
---
-
-**实施计划（修复包）**
-
-1. 修 `diagnosis` 调用链：所有 `resolveChainProbeTarget` 调用传入 `workItem.toNode.ConnectIP`。  
-2. 修 `reconstructTunnelState`：出口节点和中继节点都回填 `ConnectIP`。  
-3. 补测试：覆盖“诊断用选中IP”“重部署不丢IP”“connectIp为空仍走默认”的三组场景。  
-4. 联调验证：创建/更新、诊断、单重部署、批量重部署、联邦节点场景各跑一遍。
-
---
-
-我建议按这个范围做成一次完整修复（避免只修诊断后你再次遇到“重部署又回退”的问题）。  
-如果你同意，我下一步就按这个“全量改造范围”进入实施。
@@ -1,7 +0,0 @@
-211 任务的没有完全完成1. 选择IP后诊断还会诊断默认IP
-2. 选择隧道出口IP后，入口还是会链接默认IP，没有链接选择的IP
-请分析后制定修复计划
-
---
-
-配置下发也没兼容，请全量检查一下，哪些功能需要一起改造
@@ -1,52 +0,0 @@
-你提得很对，我按“配置下发全链路”重新过了一遍（只读分析）。结论是：**需要一起改造的不是一个点，而是“诊断链路 + 重部署链路 + 回归测试链路”**。
-
-目前状态可以分成三类：
-
- **已兼容（创建/更新时下发）**
-  - 隧道创建/更新时，`connectIp` 已进入运行时下发选择逻辑（`selectTunnelDialHost`）。
-  - 本地/联邦 runtime apply 都会吃 `target.ConnectIP`（前提是 state 里有值）。
-  - 参考：`go-backend/internal/http/handler/mutations.go:2588`, `go-backend/internal/http/handler/mutations.go:2348`
-
- **未兼容（你反馈的核心问题）**
-  - 诊断链路未传 `connectIp`，导致总走默认IP。
-  - 参考：`go-backend/internal/http/handler/control_plane.go:75`, `go-backend/internal/http/handler/control_plane.go:1102`
-
- **半兼容（配置重建时丢字段）**
-  - 重部署时从 DB 重建 runtime state，**没把 `ConnectIP` 带回去**，所以 redeploy 后会回退默认IP。
-  - 参考：`go-backend/internal/http/handler/mutations.go:883`, `go-backend/internal/http/handler/mutations.go:897`
-
---
-
-**需要一起改造的功能范围（建议一次性做完）**
-
- `诊断（非流式 + 流式）`
-  - 隧道诊断、转发诊断都要改（共用 `prepare*Diagnosis` + `appendChainHopDiagnosis`）。
-  - 流式 start 预览项也要改，否则 UI 一开始仍显示默认IP。
-  - 目标文件：`go-backend/internal/http/handler/control_plane.go`, `go-backend/internal/http/handler/diagnosis_stream.go`
-
- `配置下发（重部署路径）`
-  - 单条重部署、批量重部署都依赖 `reconstructTunnelState`，必须补 `ConnectIP` 回填。
-  - 目标文件：`go-backend/internal/http/handler/mutations.go`
-
- `联邦节点运行时下发一致性`
-  - 逻辑本身已支持 `ConnectIP`，但受上一步 state 丢字段影响；修复后自动恢复一致。
-  - 重点验证：remote middle hop `ApplyRole.Targets` 的 Host 选取。
-
- `回归测试`
-  - 新增诊断用例：选了 `connectIp` 后，`targetIp` 必须是选中值（tunnel/forward + stream start/item）。
-  - 新增重部署用例：redeploy 后仍使用 `connectIp`，不回退默认IP。
-  - 目标文件建议：`go-backend/tests/contract/diagnosis_contract_test.go`，补 handler 级或 contract 级 redeploy 用例。
-
---
-
-**实施计划（修复包）**
-
-1. 修 `diagnosis` 调用链：所有 `resolveChainProbeTarget` 调用传入 `workItem.toNode.ConnectIP`。  
-2. 修 `reconstructTunnelState`：出口节点和中继节点都回填 `ConnectIP`。  
-3. 补测试：覆盖“诊断用选中IP”“重部署不丢IP”“connectIp为空仍走默认”的三组场景。  
-4. 联调验证：创建/更新、诊断、单重部署、批量重部署、联邦节点场景各跑一遍。
-
---
-
-我建议按这个范围做成一次完整修复（避免只修诊断后你再次遇到“重部署又回退”的问题）。  
-如果你同意，我下一步就按这个“全量改造范围”进入实施。
@@ -1 +0,0 @@
-提交全部变更并且push，创建pr合并，发布新tag，alpha版本
@@ -1,10 +0,0 @@
-已完成：
-
-1. **提交**: `fix: apply custom IP binding to forward and tunnel chain services` (e383359)
-2. **PR**: [#247](https://github.com/Sagit-chu/flvx/pull/247) - 已合并
-3. **Tag**: `2.1.7-alpha7` 已创建并推送
-
-新功能：
- 自定义 IP 绑定支持（节点、隧道、转发）
- 转发列表紧凑模式与隧道组折叠/排序
- 迁移测试增强
@@ -1,40 +0,0 @@
-# Session Context
-
-Session ID: ses_34e68d081ffeyr3uWQwm5venHp
-Commit Message: 实施
-
-## Prompts
-
-### Prompt 1
-
-211任务中，如果选择了指定的入口IP或者出口IP，在节点上应该只监听这个IP地址，而不再是[::]，请检查
-
-### Prompt 2
-
-connectIp 同时用于“上游拨号目标 + 本节点监听绑定”
-
-### Prompt 3
-
-实施
-
-## Summary
-
-已实施完成，并且按你确认的语义实现为：`connectIp` 同时用于“上游拨号目标 + 本节点监听绑定”。
-
- 转发服务下发现在会优先使用 `forward_port.in_ip` 作为监听地址，不再固定用节点默认 `[::]`。
- 隧道服务下发现在会优先使用 `connectIp` 作为监听地址；为空时才回退到节点默认监听地址。
- IPv6 监听地址统一通过 `processServerAddress(...)` 处理，确保带方括号格式正确。
-
-改动位置：
- `go-backend/internal/http/handler/control_plane.go:284`
- `go-backend/internal/http/handler/control_plane.go:1306`
- `go-backend/internal/http/handler/mutations.go:2646`
-
-新增测试：
- `go-backend/internal/http/handler/control_plane_test.go:69`
- `go-backend/internal/http/handler/control_plane_test.go:86`
- `go-backend/internal/http/handler/dual_stack_test.go:33`
- `go-backend/internal/http/handler/dual_stack_test.go:49`
-
-验证结果：
- 已运行 `go test ./internal/http/handler/...`，全部通过。
@@ -1,9 +0,0 @@
-211任务中，如果选择了指定的入口IP或者出口IP，在节点上应该只监听这个IP地址，而不再是[::]，请检查
-
---
-
-connectIp 同时用于“上游拨号目标 + 本节点监听绑定”
-
---
-
-实施
@@ -1,19 +0,0 @@
-已实施完成，并且按你确认的语义实现为：`connectIp` 同时用于“上游拨号目标 + 本节点监听绑定”。
-
- 转发服务下发现在会优先使用 `forward_port.in_ip` 作为监听地址，不再固定用节点默认 `[::]`。
- 隧道服务下发现在会优先使用 `connectIp` 作为监听地址；为空时才回退到节点默认监听地址。
- IPv6 监听地址统一通过 `processServerAddress(...)` 处理，确保带方括号格式正确。
-
-改动位置：
- `go-backend/internal/http/handler/control_plane.go:284`
- `go-backend/internal/http/handler/control_plane.go:1306`
- `go-backend/internal/http/handler/mutations.go:2646`
-
-新增测试：
- `go-backend/internal/http/handler/control_plane_test.go:69`
- `go-backend/internal/http/handler/control_plane_test.go:86`
- `go-backend/internal/http/handler/dual_stack_test.go:33`
- `go-backend/internal/http/handler/dual_stack_test.go:49`
-
-验证结果：
- 已运行 `go test ./internal/http/handler/...`，全部通过。
@@ -1 +0,0 @@
-提交全部变更并且push，创建pr合并，发布新tag，alpha版本
@@ -1,5 +0,0 @@
-✅ 完成！
-
- 提交: `9cf9f4f` (feat: add comprehensive migration test for legacy columns)
- PR: [#245](https://github.com/Sagit-chu/flvx/pull/245) 已合并
- 新 tag: `2.1.7-alpha6` 已发布
@@ -1,20 +0,0 @@
-# Session Context
-
-Session ID: ses_34ebc12c1ffePWN7yC0z9iz5Lw
-Commit Message: 合并pr，然后发布新tag，alpha版本
-
-## Prompts
-
-### Prompt 1
-
-提交全部变更并且push
-
-### Prompt 2
-
-合并pr，然后发布新tag，alpha版本
-
-## Summary
-
-已完成：
- PR #244 已合并到 main
- 新 tag `2.1.7-alpha5` 已创建并推送
@@ -1,5 +0,0 @@
-提交全部变更并且push
-
---
-
-合并pr，然后发布新tag，alpha版本
@@ -1,3 +0,0 @@
-已完成：
- PR #244 已合并到 main
- 新 tag `2.1.7-alpha5` 已创建并推送
@@ -1,44 +0,0 @@
-# Session Context
-
-Session ID: ses_34ec18cadffeoVVSjfPXGJaxBu
-Commit Message: 再做一轮“跨表全量列对比（model vs 旧库补列逻辑）
-
-## Prompts
-
-### Prompt 1
-
-211任务全量再逐一确认一下是否全部完成，并且功能完成
-
-### Prompt 2
-
-添加额外ip的时候报错：SQL logic error: no such column: extra_ips (1)
-
-### Prompt 3
-
-全量排查一下还有没有类似的bug
-
-### Prompt 4
-
-再做一轮“跨表全量列对比（model vs 旧库补列逻辑）
-
-## Summary
-
-已完成这一轮“跨表全量列对比（model vs 旧库补列逻辑）”，并做了可执行验证。
-
-我做了什么：
-
- 对比了 `model.Node` / `model.Tunnel` 字段与 `prepareSQLiteLegacyColumns` 的补列清单。
- 结论：
-  - `Node` 目前应补的历史增量列：`server_ip_v4`, `server_ip_v6`, `extra_ips`, `tcp_listen_addr`, `udp_listen_addr`, `inx`, `is_remote`, `remote_url`, `remote_token`, `remote_config`
-  - `Tunnel` 应补：`inx`, `ip_preference`
- 我已把这个对齐结果固化为回归测试，新增了一个“更老版本库”场景验证：
-  - 新测试：`TestOpenMigratesVeryLegacyNodeAndTunnelColumns`
-  - 文件：`go-backend/tests/contract/migration_contract_test.go`
-  - 该测试从极简旧表结构启动，验证上述所有列都会被自动补齐。
- 测试结果：通过
-  - `go test ./tests/contract -run "TestOpenMigratesLegacyNodeDualStackColumns|TestOpenMigratesVeryLegacyNodeAndTunnelColumns"`
-
-最终结论（本轮排查范围内）：
-
- **Node/Tunnel 这条旧库升级链路已对齐且有测试兜底**。
- 你这类 “no such column” 的同类风险，针对这两个核心表已经基本封住。
@@ -1,13 +0,0 @@
-211任务全量再逐一确认一下是否全部完成，并且功能完成
-
---
-
-添加额外ip的时候报错：SQL logic error: no such column: extra_ips (1)
-
---
-
-全量排查一下还有没有类似的bug
-
---
-
-再做一轮“跨表全量列对比（model vs 旧库补列逻辑）
@@ -1,19 +0,0 @@
-已完成这一轮“跨表全量列对比（model vs 旧库补列逻辑）”，并做了可执行验证。
-
-我做了什么：
-
- 对比了 `model.Node` / `model.Tunnel` 字段与 `prepareSQLiteLegacyColumns` 的补列清单。
- 结论：
-  - `Node` 目前应补的历史增量列：`server_ip_v4`, `server_ip_v6`, `extra_ips`, `tcp_listen_addr`, `udp_listen_addr`, `inx`, `is_remote`, `remote_url`, `remote_token`, `remote_config`
-  - `Tunnel` 应补：`inx`, `ip_preference`
- 我已把这个对齐结果固化为回归测试，新增了一个“更老版本库”场景验证：
-  - 新测试：`TestOpenMigratesVeryLegacyNodeAndTunnelColumns`
-  - 文件：`go-backend/tests/contract/migration_contract_test.go`
-  - 该测试从极简旧表结构启动，验证上述所有列都会被自动补齐。
- 测试结果：通过
-  - `go test ./tests/contract -run "TestOpenMigratesLegacyNodeDualStackColumns|TestOpenMigratesVeryLegacyNodeAndTunnelColumns"`
-
-最终结论（本轮排查范围内）：
-
- **Node/Tunnel 这条旧库升级链路已对齐且有测试兜底**。
- 你这类 “no such column” 的同类风险，针对这两个核心表已经基本封住。
@@ -1,14 +0,0 @@
-# Session Context
-
-Session ID: ses_34eec2495ffeJvDq7SlEs8mRoH
-Commit Message: 提交全部变更并且push，创建pr
-
-## Prompts
-
-### Prompt 1
-
-提交全部变更并且push，创建pr
-
-## Summary
-
-已提交并推送，PR已创建: https://github.com/Sagit-chu/flvx/pull/new/opencode/mighty-nebula
@@ -1 +0,0 @@
-提交全部变更并且push，创建pr
@@ -1 +0,0 @@
-已提交并推送，PR已创建: https://github.com/Sagit-chu/flvx/pull/new/opencode/mighty-nebula
@@ -1,14 +0,0 @@
-# Session Context
-
-Session ID: ses_34f0fe1d2ffeH3PJRyokYati7T
-Commit Message: 把main更新到本分支
-
-## Prompts
-
-### Prompt 1
-
-把main更新到本分支
-
-## Summary
-
-已完成 `origin/main` 合并到当前分支（Fast-forward）。之前的更改已恢复，`forward.tsx` 自动合并成功。
@@ -1 +0,0 @@
-把main更新到本分支
@@ -1 +0,0 @@
-已完成 `origin/main` 合并到当前分支（Fast-forward）。之前的更改已恢复，`forward.tsx` 自动合并成功。
@@ -1,11 +0,0 @@
-探索节点API和数据访问层的完整实现：
-
-1. 在 `go-backend/internal/store/repo/` 查找节点创建/更新的函数
-2. 查找节点数据如何返回给前端（JSON序列化）
-3. 查找 `nodeRecord` 结构体的定义和使用
-4. 理解 ServerIP/ServerIPV4/ServerIPV6 字段如何被处理
-
-返回：
- 节点CRUD相关的Repository方法
- 节点数据返回给前端的格式
- 扩展节点IP字段需要改动的位置
@@ -1,215 +0,0 @@
-Based on my thorough exploration, here's a comprehensive analysis of the node API and data access layer:
-
---
-
-## 节点API和数据访问层完整分析
-
-### 1. 节点CRUD相关Repository方法
-
-#### 核心方法 (`go-backend/internal/store/repo/`)
-
-| 方法 | 文件位置 | 功能 |
-|------|----------|------|
-| `CreateNode()` | `repository_mutations.go:199` | 创建节点，处理 serverIP/serverIPV4/serverIPV6 |
-| `UpdateNode()` | `repository_mutations.go:241` | 更新节点，包含所有IP字段 |
-| `DeleteNodeCascade()` | `repository_mutations.go:299` | 级联删除节点（关联 ForwardPort、ChainTunnel、FederationTunnelBinding） |
-| `GetNodeByID()` | `repository.go:555` | 通过ID获取节点 |
-| `GetNodeBySecret()` | `repository.go:540` | 通过Secret获取节点 |
-| `GetNodeStatusFields()` | `repository_mutations.go:229` | 获取节点状态字段 |
-| `GetNodeSecret()` | `repository_mutations.go:263` | 获取节点密钥 |
-| `GetNodeRemoteFields()` | `repository_mutations.go:317` | 获取远程节点字段 |
-| `GetNodePortRange()` | `repository_mutations.go:336` | 获取节点端口范围 |
-| `UpdateNodeOrder()` | `repository_mutations.go:287` | 更新节点排序 |
-| `UpdateNodeOnline()` | `repository.go:570` | 更新节点在线状态 |
-| `UpdateNodeStatus()` | `repository.go:580` | 更新节点状态 |
-| `ListNodes()` | `repository.go:625` | 列出所有节点（返回JSON map格式） |
-| `GetNodeRecord()` | `repository_control.go:131` | 获取 NodeRecord 视图对象 |
-| `CreateRemoteNode()` | `repository_federation.go:266` | 创建远程节点（联邦场景） |
-| `exportNodes()` | `repository.go:1660` | 导出节点数据（用于备份） |
-| `importNodes()` | `repository.go:2016` | 导入节点数据（用于恢复） |
-
---
-
-### 2. 节点数据结构定义
-
-#### GORM模型 (`model.Node` - 数据库存储)
-**文件:** `/go-backend/internal/store/model/model.go:59-82`
-```go
-type Node struct {
-    ID            int64          `gorm:"primaryKey;autoIncrement"`
-    Name          string         `gorm:"type:varchar(100);not null"`
-    Secret        string         `gorm:"type:varchar(100);not null"`
-    ServerIP      string         `gorm:"column:server_ip;type:varchar(100);not null"`
-    ServerIPV4    sql.NullString `gorm:"column:server_ip_v4;type:varchar(100)"`  // 注意：V大写
-    ServerIPV6    sql.NullString `gorm:"column:server_ip_v6;type:varchar(100)"`
-    // ... 其他字段
-}
-```
-
-#### 控制平面视图 (`model.NodeRecord`)
-**文件:** `/go-backend/internal/store/model/model.go:515-531`
-```go
-type NodeRecord struct {
-    ID            int64
-    Name          string
-    ServerIP      string
-    ServerIPv4    string   // 注意：v小写
-    ServerIPv6    string
-    Status        int
-    PortRange     string
-    // ... 其他字段
-}
-```
-
-#### JSON导出格式 (`model.NodeBackup`)
-**文件:** `/go-backend/internal/store/model/model.go:333-356`
-```go
-type NodeBackup struct {
-    ID            int64  `json:"id"`
-    Name          string `json:"name"`
-    ServerIP      string `json:"serverIp"`
-    ServerIPv4    string `json:"serverIpV4,omitempty"`
-    ServerIPv6    string `json:"serverIpV6,omitempty"`
-    // ... 其他字段
-}
-```
-
-#### Handler层别名
-**文件:** `/go-backend/internal/http/handler/control_plane.go:25`
-```go
-type nodeRecord = model.NodeRecord  // 类型别名
-```
-
---
-
-### 3. 节点数据返回给前端的格式
-
-#### ListNodes API (`repository.go:625-652`)
-```go
-// 返回 map[string]interface{} 格式
-items = append(items, map[string]interface{}{
-    "id": n.ID, "inx": n.Inx, "name": n.Name,
-    "ip": n.ServerIP, "serverIp": n.ServerIP,      // ip和serverIp都返回
-    "serverIpV4":    nullableString(n.ServerIPV4),
-    "serverIpV6":    nullableString(n.ServerIPV6),
-    "port":          n.Port,
-    "tcpListenAddr": n.TCPListenAddr,
-    "udpListenAddr": n.UDPListenAddr,
-    "version":       nullableString(n.Version),
-    "http":          n.HTTP, "tls": n.TLS, "socks": n.Socks,
-    "status": n.Status, "isRemote": n.IsRemote,
-    // ...
-})
-```
-
-#### API端点
-| 端点 | Handler | 功能 |
-|------|---------|------|
-| `POST /api/v1/node/list` | `h.nodeList` | 列出节点 |
-| `POST /api/v1/node/create` | `h.nodeCreate` | 创建节点 |
-| `POST /api/v1/node/update` | `h.nodeUpdate` | 更新节点 |
-| `POST /api/v1/node/delete` | `h.nodeDelete` | 删除节点 |
-
---
-
-### 4. ServerIP/ServerIPV4/ServerIPV6 字段处理逻辑
-
-#### 字段命名约定
-| 层级 | 字段名 | 数据库列名 |
-|------|--------|-----------|
-| `model.Node` | `ServerIPV4`, `ServerIPV6` | `server_ip_v4`, `server_ip_v6` |
-| `model.NodeRecord` | `ServerIPv4`, `ServerIPv6` | - (内存结构) |
-| `model.NodeBackup` | `ServerIPv4`, `ServerIPv6` | - (JSON) |
-| 前端JSON | `serverIpV4`, `serverIpV6` | - |
-
-#### 模型转换函数 (`repository_control.go:161-201`)
-```go
-func nodeRecordFromModel(n *model.Node) *model.NodeRecord {
-    rec := &model.NodeRecord{
-        ID:            n.ID,
-        Name:          n.Name,
-        ServerIP:      n.ServerIP,
-        // ...
-    }
-    if n.ServerIPV4.Valid {
-        rec.ServerIPv4 = strings.TrimSpace(n.ServerIPV4.String)
-    }
-    if n.ServerIPV6.Valid {
-        rec.ServerIPv6 = strings.TrimSpace(n.ServerIPV6.String)
-    }
-    // ...
-}
-```
-
-#### Dual-Stack辅助函数 (`mutations.go:2715-2772`)
-```go
-// 判断节点是否支持IPv4
-func nodeSupportsV4(node *nodeRecord) bool {
-    if strings.TrimSpace(node.ServerIPv4) != "" { return true }
-    if strings.TrimSpace(node.ServerIPv6) != "" { return false }
-    // 回退到 ServerIP 判断
-    legacy := strings.Trim(strings.TrimSpace(node.ServerIP), "[]")
-    if ip := net.ParseIP(legacy); ip != nil {
-        return ip.To4() != nil
-    }
-    return true
-}
-
-// 选择IPv4地址（优先显式字段，回退ServerIP）
-func pickNodeAddressV4(node *nodeRecord) string {
-    if v := strings.TrimSpace(node.ServerIPv4); v != "" { return v }
-    return strings.TrimSpace(node.ServerIP)
-}
-```
-
---
-
-### 5. 扩展节点IP字段需要改动的位置
-
-如果要添加新的IP字段（如 `ServerIPV4Alt`），需要修改以下位置：
-
-#### A. 模型层 (`go-backend/internal/store/model/model.go`)
-1. **`model.Node`** - 添加 GORM 字段定义（约第64行）
-2. **`model.NodeRecord`** - 添加视图字段（约第520行）
-3. **`model.NodeBackup`** - 添加JSON字段（约第338行）
-
-#### B. Repository层 (`go-backend/internal/store/repo/`)
-1. **`repository_mutations.go`**
-   - `CreateNode()` 参数和赋值（约第199-227行）
-   - `UpdateNode()` 参数和Updates map（约第241-261行）
-
-2. **`repository_control.go`**
-   - `nodeRecordFromModel()` 转换逻辑（约第161-201行）
-
-3. **`repository_federation.go`**
-   - `CreateRemoteNode()` 参数和赋值（约第266-294行）
-
-4. **`repository.go`**
-   - `ListNodes()` JSON返回格式（约第625-652行）
-   - `exportNodes()` 导出逻辑（约第1660-1700行）
-   - `importNodes()` 导入逻辑（约第2016-2057行）
-   - `prepareSQLiteLegacyColumns()` 迁移逻辑（约第263行）
-
-#### C. Handler层 (`go-backend/internal/http/handler/`)
-1. **`mutations.go`**
-   - `nodeCreate()` 请求参数解析（约第234-279行）
-   - `nodeUpdate()` 请求参数解析（约第281-336行）
-   - `nodeSupportsV4/V6()` 函数逻辑（约第2715-2772行）
-   - `pickNodeAddressV4/V6()` 函数逻辑
-
-#### D. 测试层 (`go-backend/tests/contract/`)
-所有 contract test 中的 `INSERT INTO node` 语句需要更新字段列表
-
---
-
-### 关键文件汇总
-
-| 文件 | 用途 |
-|------|------|
-| `/go-backend/internal/store/model/model.go` | 数据模型定义 |
-| `/go-backend/internal/store/repo/repository_mutations.go` | CRUD操作实现 |
-| `/go-backend/internal/store/repo/repository_control.go` | 控制平面查询+模型转换 |
-| `/go-backend/internal/store/repo/repository_federation.go` | 联邦节点操作 |
-| `/go-backend/internal/store/repo/repository.go` | 核心查询+导出导入 |
-| `/go-backend/internal/http/handler/mutations.go` | HTTP API处理器 |
-| `/go-backend/internal/http/handler/control_plane.go` | 控制平面API |
@@ -1,11 +0,0 @@
-探索隧道链路构建时下一跳连接地址的选择流程：
-
-1. 在 `control_plane.go` 中查找隧道链路构建逻辑
-2. 查找 `applyTunnelRuntime` 或类似函数如何向节点发送命令
-3. 理解 hop 节点如何连接到下一个节点（连接地址从哪里来）
-4. 查找 `ChainTunnel` 表的 `Port` 字段如何被使用
-
-返回：
- 隧道链路配置发送到节点的代码位置
- 下一跳连接地址是如何确定的
- 修改连接地址需要改动的关键位置
@@ -1,173 +0,0 @@
-根据我的分析，以下是隧道链路构建时下一跳连接地址选择流程的完整报告：
-
---
-
-## 隧道链路构建流程分析报告
-
-### 1. 隧道链路配置发送到节点的代码位置
-
-**主函数**: `applyTunnelRuntime()` 
- 文件: `go-backend/internal/http/handler/mutations.go`
- 行号: 2454-2521
-
-**核心流程**:
-
-```
-applyTunnelRuntime (L2454)
-├── 入口节点: 发送 AddChains 命令 (L2474)
-├── 跳转节点: 发送 AddChains (L2496) + AddService (L2502) 命令
-└── 出口节点: 发送 AddService 命令 (L2514)
-```
-
-**配置构建函数**:
-| 函数 | 位置 | 作用 |
-|------|------|------|
-| `buildTunnelChainConfig()` | L2567-2624 | 构建转发链配置 |
-| `buildTunnelChainServiceConfig()` | L2626-2652 | 构建服务配置 |
-| `selectTunnelDialHost()` | L2654-2699 | **选择下一跳连接地址** |
-
---
-
-### 2. 下一跳连接地址是如何确定的
-
-**地址选择核心函数**: `selectTunnelDialHost()` (L2654-2699)
-
-```go
-// 关键逻辑 (简化版)
-func selectTunnelDialHost(fromNode, toNode *nodeRecord, ipPreference string) (string, error) {
-    // 1. 检测源节点和目标节点的 IPv4/IPv6 支持
-    fromV4 := nodeSupportsV4(fromNode)
-    fromV6 := nodeSupportsV6(fromNode)
-    toV4 := nodeSupportsV4(toNode)
-    toV6 := nodeSupportsV6(toNode)
-    
-    // 2. 根据偏好选择地址
-    switch ipPreference {
-    case "v6":  // 优先 IPv6
-        if fromV6 && toV6 { return pickNodeAddressV6(toNode) }
-        if fromV4 && toV4 { return pickNodeAddressV4(toNode) }
-    case "v4":  // 优先 IPv4
-        if fromV4 && toV4 { return pickNodeAddressV4(toNode) }
-        if fromV6 && toV6 { return pickNodeAddressV6(toNode) }
-    default:    // 默认优先 IPv4
-        if fromV4 && toV4 { return pickNodeAddressV4(toNode) }
-        if fromV6 && toV6 { return pickNodeAddressV6(toNode) }
-    }
-    // 3. 不兼容时报错
-    return "", fmt.Errorf("节点链路不兼容")
-}
-```
-
-**地址选择优先级** (在 `pickNodeAddressV4/V6` 中, L2755-2773):
- **IPv4**: `ServerIPv4` > `ServerIP` (旧字段)
- **IPv6**: `ServerIPv6` > `ServerIP` (旧字段)
-
-**端口来源** (在 `buildTunnelChainConfig` 中, L2585-2588):
-```go
-port := target.Port  // 来自 ChainTunnel.Port 字段
-if port <= 0 {
-    return nil, errors.New("节点端口不能为空")
-}
-```
-
---
-
-### 3. ChainTunnel.Port 字段的使用流程
-
-**数据模型** (`model.go` L127-138):
-```go
-type ChainTunnel struct {
-    ID        int64
-    TunnelID  int64
-    ChainType string      // "1"=入口, "2"=跳转, "3"=出口
-    NodeID    int64
-    Port      sql.NullInt64  // ★ 连接端口
-    Strategy  sql.NullString
-    Inx       sql.NullInt64  // 跳转序号
-    Protocol  sql.NullString
-}
-```
-
-**Port 字段流转**:
-
-```
-创建隧道时
-    │
-    ▼
-prepareTunnelCreateState (L1970)
-├── 出口节点: 从请求读取 port，若为空则调用 PickNodePortTx 自动分配
-├── 跳转节点: 从请求读取 port，若为空则调用 PickNodePortTx 自动分配
-    │
-    ▼
-replaceTunnelChainsTx (L2775) 
-└── CreateChainTunnelTx 写入数据库 (L2809, L2837)
-    │
-    ▼
-读取/重建状态时
-    │
-    ▼
-ListChainNodesForTunnel (repository_control.go L280)
-└── 从 chain_tunnel 表读取 Port 字段 (L295)
-    │
-    ▼
-reconstructTunnelState (L845)
-└── 将 Port 复制到 tunnelRuntimeNode.Port (L887, L901)
-    │
-    ▼
-buildTunnelChainConfig (L2567)
-└── 使用 target.Port 构建连接地址 (L2585)
-```
-
---
-
-### 4. 修改连接地址需要改动的关键位置
-
-如果要修改下一跳连接地址的选择逻辑，需要关注以下位置：
-
-| 修改目标 | 文件 | 行号 | 函数 |
-|---------|------|------|------|
-| **IP地址选择策略** | `mutations.go` | L2654-2699 | `selectTunnelDialHost()` |
-| **IPv4地址提取** | `mutations.go` | L2755-2763 | `pickNodeAddressV4()` |
-| **IPv6地址提取** | `mutations.go` | L2765-2773 | `pickNodeAddressV6()` |
-| **端口获取** | `mutations.go` | L2585-2588 | `buildTunnelChainConfig()` |
-| **端口分配逻辑** | `repository_mutations.go` | ~L459 | `PickNodePortTx()` |
-| **端口写入数据库** | `repository_mutations.go` | L398-406 | `CreateChainTunnelTx()` |
-| **端口从数据库读取** | `repository_control.go` | L280-343 | `ListChainNodesForTunnel()` |
-
-**关键配置结构**:
-```go
-// mutations.go L1950-1957
-type tunnelRuntimeNode struct {
-    NodeID    int64
-    Protocol  string   // 连接协议
-    Strategy  string   // 选择策略
-    Inx       int      // 跳转序号
-    ChainType int      // 1=入口, 2=跳转, 3=出口
-    Port      int      // ★ 连接端口
-}
-```
-
---
-
-### 5. 调用链总结
-
-```
-用户创建隧道请求
-    │
-    ▼
-tunnelAdd (mutations.go L450)
-    │
-    ├── prepareTunnelCreateState() ──► 分配端口，构建 state
-    │
-    ├── replaceTunnelChainsTx() ──► 写入 chain_tunnel 表
-    │
-    └── applyTunnelRuntime()
-            │
-            ├── buildTunnelChainConfig()
-            │       │
-            │       ├── selectTunnelDialHost() ──► 选择 IP 地址
-            │       │
-            │       └── 使用 target.Port ──► 端口
-            │
-            └── sendNodeCommand("AddChains/AddService") ──► 发送到节点
-```
@@ -1,11 +0,0 @@
-探索转发创建时入口IP的生成流程：
-
-1. 查找 `buildTunnelInIP` 函数的完整实现
-2. 查找 `resolveForwardIngress` 函数的完整实现
-3. 理解 `forward_port` 表如何与节点IP关联
-4. 查找转发创建API（createForward）如何处理入口端口分配
-
-返回：
- 关键代码片段和行号
- 入口IP是如何从节点信息中提取的
- 修改入口IP需要改动的关键位置
@@ -1,185 +0,0 @@
-现在我已经找到了完整的入口IP生成流程。让我整理并返回关键信息：
-
---
-
-## 入口IP生成流程分析
-
-### 1. `buildTunnelInIP` 函数 (创建/更新隧道时)
-
-**位置**: `go-backend/internal/http/handler/mutations.go:2112-2152`
-
-```go
-func buildTunnelInIP(inNodes []tunnelRuntimeNode, nodes map[int64]*nodeRecord, ipPreference string) string {
-    set := make(map[string]struct{})
-    ordered := make([]string, 0)
-    preferV6 := strings.TrimSpace(ipPreference) == "v6"
-    for _, inNode := range inNodes {
-        node := nodes[inNode.NodeID]
-        if node == nil {
-            continue
-        }
-        v4 := strings.TrimSpace(node.ServerIPv4)   // 从节点获取 IPv4
-        v6 := strings.TrimSpace(node.ServerIPv6)   // 从节点获取 IPv6
-        var addrs []string
-        if preferV6 {
-            if v6 != "" { addrs = append(addrs, v6) }
-            if v4 != "" { addrs = append(addrs, v4) }
-        } else {
-            if v4 != "" { addrs = append(addrs, v4) }
-            if v6 != "" { addrs = append(addrs, v6) }
-        }
-        if len(addrs) == 0 {
-            if v := strings.TrimSpace(node.ServerIP); v != "" {  // fallback 到 ServerIP
-                addrs = append(addrs, v)
-            }
-        }
-        // ... 去重后拼接
-    }
-    return strings.Join(ordered, ",")
-}
-```
-
-**调用位置**:
- 隧道创建: `mutations.go:496`
- 隧道更新: `mutations.go:693`
-
---
-
-### 2. `resolveForwardIngress` 函数 (查询转发时)
-
-**位置**: `go-backend/internal/store/repo/repository.go:2727-2796`
-
-```go
-func resolveForwardIngress(db *gorm.DB, forwardID int64, tunnelID int64) (string, sql.NullInt64, error) {
-    // 1. 首先从 tunnel 表获取 in_ip (由 buildTunnelInIP 生成)
-    var tunnelInIP sql.NullString
-    db.Model(&model.Tunnel{}).Select("in_ip").Where("id = ?", tunnelID).Limit(1).Scan(&tunnelInIP)
-
-    // 2. 从 forward_port + node 表获取端口和节点IP
-    type fpRow struct {
-        Port     sql.NullInt64
-        ServerIP sql.NullString
-    }
-    var fpRows []fpRow
-    err := db.Model(&model.ForwardPort{}).
-        Select("forward_port.port, node.server_ip").
-        Joins("LEFT JOIN node ON node.id = forward_port.node_id").
-        Where("forward_port.forward_id = ?", forwardID).
-        Order("forward_port.id ASC").
-        Find(&fpRows).Error
-
-    // 3. 组装入口地址
-    // - 如果 tunnel.in_ip 存在: "ip1:port,ip2:port..."
-    // - 否则使用 forward_port 关联的 node.server_ip: "ip:port"
-    // ...
-}
-```
-
-**调用位置**:
- `repository.go:495` - 用户转发列表
- `repository.go:730` - 管理员转发列表
-
---
-
-### 3. `forward_port` 表与节点IP关联
-
-**模型定义**: `go-backend/internal/store/model/model.go:50-57`
-
-```go
-type ForwardPort struct {
-    ID        int64 `gorm:"primaryKey;autoIncrement"`
-    ForwardID int64 `gorm:"column:forward_id;not null"`
-    NodeID    int64 `gorm:"column:node_id;not null"`   // 关联到 node.id
-    Port      int   `gorm:"not null"`
-}
-```
-
-**关联查询** (在 `resolveForwardIngress` 中):
-```sql
-SELECT forward_port.port, node.server_ip
-FROM forward_port
-LEFT JOIN node ON node.id = forward_port.node_id
-WHERE forward_port.forward_id = ?
-ORDER BY forward_port.id ASC
-```
-
---
-
-### 4. 转发创建API入口分配流程
-
-**入口函数**: `go-backend/internal/http/handler/mutations.go:1108-1194`
-
-```go
-func (h *Handler) forwardCreate(w http.ResponseWriter, r *http.Request) {
-    // 1. 获取隧道入口节点IDs
-    entryNodes, _ := h.tunnelEntryNodeIDs(tunnelID)  // line 1162
-    
-    // 2. 获取或选择入口端口
-    port := asInt(req["inPort"], 0)
-    if port <= 0 {
-        port = h.pickTunnelPort(tunnelID)  // 自动分配端口 (line 1157)
-    }
-    
-    // 3. 创建转发记录 + forward_port 记录
-    forwardID, err := h.repo.CreateForwardTx(..., entryNodes, port, ...)  // line 1179
-}
-```
-
-**`CreateForwardTx`**: `go-backend/internal/store/repo/repository_mutations.go:1171-1209`
-```go
-func (r *Repository) CreateForwardTx(..., entryNodeIDs []int64, port int, ...) (int64, error) {
-    // 创建 forward 记录
-    // 为每个入口节点创建 forward_port 记录
-    for _, nodeID := range entryNodeIDs {
-        fp := model.ForwardPort{
-            ForwardID: forwardID,
-            NodeID:    nodeID,    // 入口节点ID
-            Port:      port,      // 入口端口
-        }
-        tx.Create(&fp)
-    }
-}
-```
-
-**入口节点获取**: `repository_mutations.go:535-548`
-```go
-func (r *Repository) TunnelEntryNodeIDs(tunnelID int64) ([]int64, error) {
-    // 从 chain_tunnel 表查询 chain_type = 1 (入口) 的节点
-    r.db.Model(&model.ChainTunnel{}).
-        Where("tunnel_id = ? AND chain_type = ?", tunnelID, "1").
-        Order("inx ASC, id ASC").
-        Pluck("node_id", &ids)
-}
-```
-
---
-
-## 关键修改位置
-
-| 需求 | 修改文件 | 行号 | 说明 |
-|------|----------|------|------|
-| **修改隧道入口IP生成逻辑** | `mutations.go` | 2112-2152 | `buildTunnelInIP` 函数，控制IPv4/IPv6优先级和组合 |
-| **修改转发入口IP解析** | `repository.go` | 2727-2796 | `resolveForwardIngress`，控制入口地址格式 |
-| **修改端口自动分配** | `mutations.go` | 2901-2964 | `pickTunnelPort`，控制端口范围选择 |
-| **修改入口节点关联** | `repository_mutations.go` | 1196-1205 | `CreateForwardTx` 中的 forward_port 创建 |
-| **节点IP来源** | `model.go` | 516-531 | `NodeRecord` 结构体 |
-| **节点IP存储** | `model.go` | 59-65 | `Node` 模型: `ServerIP`, `ServerIPV4`, `ServerIPV6` |
-
---
-
-## 入口IP数据流
-
-```
-1. 节点注册 → Node表存储 server_ip, server_ip_v4, server_ip_v6
-
-2. 创建隧道:
-   chain_tunnel (入口节点) → buildTunnelInIP() → tunnel.in_ip 字段
-
-3. 创建转发:
-   隧道入口节点IDs → forward_port(forward_id, node_id, port)
-
-4. 查询转发入口:
-   forward_port JOIN node → resolveForwardIngress()
-   ├─ 优先使用 tunnel.in_ip (多IP组合)
-   └─ 否则用 forward_port 关联的 node.server_ip
-```
@@ -1,16 +0,0 @@
-Explore the codebase to understand how forwarding/tunnel configuration works. I need to find:
-
-1. Frontend: The forwarding edit/create dialog component (likely in vite-frontend/src/)
-2. Backend: The forwarding data model and API handlers (likely in go-backend/)
-3. How the current "入口端口" (entry port) is handled
-
-Look for:
- Files related to "forward" or "转发" or "tunnel" or "隧道"
- Data models for forwarding rules
- API handlers for creating/editing forwards
-
-Return:
- Key file paths and their purposes
- Current data model structure for forwards
- How the entry listener is currently configured
- Any existing IP-related fields in the model
@@ -1,316 +0,0 @@
-              // List in frontend display isPort.)?
-
-
-      if (in_ip !== in.re.selected) {
-tunnel ip !== node in_tunnel.port_range value
-              select(v4 or IPv6, and
-              .chainType = chainType === 1 ( then chain_node !== node to check if `in_ip` is still used:
-              "chain_node_id" for `chainTunnels.node_id = nodeId, && `chainType != "hop" fields
-
-              //
-              }
-            }
-            }
-
-              <Select
-                <div className="flex flex-col gap-4 mt-6">
-              <Select
-                isFilterModalOpen={false}
-                setFilterUserId, filterTunnelId(tunnelId)}
-              }}
-              <form.in_port}
-                :form.in_port !== null,
-            }}
-          } else {
-setFilterTunnelId}
-              }
-            }}
-            // handleEntryNodeIDs
- hop - entry port assignment
-              const { entryNodeID, entryPort, entry_ip, resolvedFor forwardIn_ip based on
- forward data view:
-          In entity links the node,entry, remote_addr and`]
- tdCompose groups
-
- remote nodes by hostname.
- `target_addr` is multiple ones, the `targetAddr`/ `name` || `strategy: data in the form, uses the latest text.
-
- `line text: `grid gap-3 group` leading to border. from UI styles 
-  `.sort order`actions`: data
- ? `no-frontend for/not directly modify forward model
- so it doesn't have `inPort` in model.For forward creation.```
-
-        const forwardPort = entryNodeIDs with port = 0
- are - but tunnels and tunnels have
- after:. Based on.
-
- to reach the entry from. specified port-based" entry_ip, `addr_text` field or tunnel IP-based tunnel values with data not used this rules
- step pattern is`node-based:`peer` or a`IP_preference` + `ip_preference` header.
-
- "IP_preference from}
-        `grep<include="*.tsx"" path="/Users/sagit/.local/share/opencode/worktree/13650be91caa3a9e08a2e63127fef62757658384/mighty-nebula/vite-frontend/src/pages/forward.tsx" />
- "peer_share" and "federation" share" APIs.
-        data models
-        />
-    < Frontend> `in_ip` comes from the tunnel, and not the node model.In Go-gost.
-
-. I will specifically look at `port` and `forward_port` data stored in `forward_port` table (`                      // When editing, forward, the UI keeps the current port value in the `inPort` state is checked for duplicates (`
- forwards list ( addresses with multiple addresses.
-
-          </div
-        }
-      </div>
-        }
-      }
-    }
-  }
-        className="flex flex-col gap-4">
-          {/* form fields - in edit mode */}
-          </4-form.inPort in field and handleClick save
- validation and numbers? `handleEdit` adds the `inPort` to the and `inPort` state.
-          // handleDragEnd ref={handleDragEnd} to scroll into view}
-          if (prev.forwardPorts.length === 0) {
-            // Create new forward
- entry with not auto expanded
-          const inPort records = || const{index` === 0` ? record and `forward_ports` table
-            const inPort = records = or can be rendered when the to pickTunnelPort:           the empty { inPort = null ?} => to persistent if port === 0 ( automatic assignment).
-          } else {
-            toast.error("请选择关联隧道")
-          }
-          const minPort =
-              const ports = oldPorts.map((p) => p)) // values from request
-          // value === 0 means "端口不能为空，  else if (!port) {
-            const inPort = tunnelPorts.map((t) => {
-              const inIP = tunnel = in_ip
- || t.IP === the default) 'auto' (available, tunnel.ip_preference` || `:` if` in_ip` and `in_port` values ( listenAddr] which`tcp`/udp` addresses are the respectively
-            `forward` now supports select/un/selected tunnel. when not found ( a single ` address can be shown, and simplified overview.= `tunnel` but has `in_ip` display name="人口入口IP` and "端口转发" when tunnel is port-forward, the model oftrafficRatio` floats with `type` and `protocol` fields.
-
-          // `protocol`: 'tls' | 'wss' | 'mtls' | 'mtcp'
- for `type` === 1: 繀 端口转发, 2: 隧道转发, and `type` determines the listeners on which forward ( protocol, and exit node ( configuration. Let `traffic_ratio` be on in/out, and the name` tunnelName, in the `UserTunnel` table
-    var chainType = chainType === "entry" ? # chainType === 2, value for represents entry node id for chain_type === "hop", fields indicate which hop number (1-based, `strategy` on the current value)
-
-                    ? newErrors.inPort = "端口必须在1-65535之间";
-                  form.inPort = optional
- required validation in  if filled, values to 0 or null, then the port is is auto-assigned
-                      } ValidateForm()
-                      if (validateForm()) {
-        setErrors(newErrors);
-      }
-    }
-  };
-  const handleTunnelChange = (tunnelId: string) => {
-    setForm((prev) => ({ ...prev, tunnelId}));
-    : if (prev.inPort !== null && prev.inPort !== old, in port assignment will not assign the new port  auto
-                });
-                }
-              );
-            } else {
-              inPort = null
-            : options.speedId = speedLimit }
-              onChange={(selectedKey) => {
-                setFilter((prev) => ({ ...prev, speedId, speedName }));
-            }
-          });
-        });
-              setBatchChangeTunnelModalOpen(false);
-              setBatchChangeTunnelModalOpen(false);
-            }
-          </div>
-          </div>
-        );
-      <input
-inport}
- */
-.tsx
-      <Input
-              description="指定入口端口，留空则从节点可用端口中自动分配"
-              placeholder="留空则自动分配可用端口"
-              type="number"
-              variant="bordered"
-              onChange={(e) => {
-                const value = e.target.value ? ""
-                  : parseInt(value) || null)
-                  setForm((prev) => ({ ...prev, inPort: null}));
-              </div>
-          </div>
-          <ModalContent>
-            <ModalHeader className="flex flex-col gap-1">
-              <h2 className="text-xl font-bold">
-                {isEdit ? "编辑转发" : "新增转发"}
-                </h2>
-                <p className="text-small text-default-500 mt-4">
-                  {isEdit ? "修改现有转发配置的信息" : "创建新的转发配置"}
-                </p>
-              <ModalBody>
-                <div className="space-y-4 pb-4">
-                  <Input
-                    errorMessage={errors.name}
-                    isInvalid={!!errors.name}
-                    label="转发名称"
-                    placeholder="请输入转发名称"
-                    value={form.name}
-                    variant="bordered"
-                    onChange={(e) =>
-                      setForm((prev) => ({ ...prev, name: e.target.value }))
-                    }
-                  />
-
-                  {/* Limit速规则选择 */}
-                  <Select
-                    description="限速规则"
-                    placeholder="不限速"
-                    selectedKeys={
-                      selectedSpeedId !== null ? ?[selectedSpeedId.toString()] : []
-                    }
-                    variant="bordered"
-                    onSelectionChange={(keys) => {
-                      const selectedKey = Array.from(keys)[0] as string | undefined;
-                      setForm((prev) => ({
-                        ...prev,
-                        speedId: selectedKey ? Number(selectedKey) : null,
-                      });
-                    }}
-                  />
-
-                  {/*隧道选择 */}
-                  <Select
-                    description={
-                      isEdit
-                        ? "更改隧道将释放原端口并在新隧道分配端口"
-                        : "更改隧道后重新分配端口并同步到节点"
-                  }
-                    }
-                    errorMessage={errors.tunnelId}
-                    isInvalid={!!errors.tunnelId}
-                    label="选择隧道"
-                    placeholder="请选择关联的隧道"
-                    selectedKeys={
-                      form.tunnelId ? [form.tunnelId.toString()] : []
-                    }
-                    variant="bordered"
-                    onSelectionChange={(keys) => {
-                      const selectedKey = Array.from(keys)[0] as string;
-                      if (selectedKey) {
-                        handleTunnelChange(selectedKey);
-                      }
-                    }
-                  />
-
-                  {/*入口端口 */}
-                  <Input
-                    description="指定入口端口，留空则从节点可用端口中自动分配"
-                    errorMessage={errors.inPort}
-                    isInvalid={!!errors.inPort}
-                    label="入口端口"
-                    placeholder="留空则自动分配可用端口"
-                    type="number"
-                    value={form.inPort !== null ? form.inPort.toString() : ""}
-                    variant="bordered"
-                    onChange={(e) => {
-                      const value = e.target.value;
-                      setForm((prev) => ({ ...prev, inPort: value ? parseInt(value) : null }));
-                    }
-                  />
-                </div>
-          </ModalBody>
-        </ModalContent>
-      </Modal>
-    </Modal>
-  );
-};
-
-  // ===================== Summary of findings ===================
-
-## Key File Paths and their purposes:
-
-### Frontend: Forward Edit/create dialog component
- **Main file:** `/Users/sagit/.local/share/opencode/worktree/13650be91caa3a9e08a2e63127fef62757658384/mighty-nebula/vite-frontend/src/pages/forward.tsx`
-  - Displays the forwarding list and handles all create/edit/delete/forwards
- Has `inIp` and `inPort` fields
- Shows entry port and dialog/form with validation
- Uses React-hook-form with state management
- Calls `createForward`, `updateForward`, `deleteForward`, `pauseForwardService`, `resumeForwardService`, APIs
-
- Imports API functions from `@/api`
-
-### Backend: Forwarding data model and API handlers
- **Main model file:** `/Users/sagit/.local/share/opencode/worktree/13650be91caa3a9e08a2e63127fef62757658384/mighty-nebula/go-backend/internal/store/model/model.go`
-  - GORM model definition for `Forward` struct does basic forwarding configuration
-  - Related models: `ForwardPort`, `Tunnel`, `UserForwardDetail` (view struct)
-
-  - **API handlers:** `/Users/sagit/.local/share/opencode/worktree/13650be91caa3a9e08a2e63127fef62757658384/mighty-nebula/go-backend/internal/http/handler/mutations.go`
-  - Create/update/delete operations
-  - Entry port handling via `inPort` field
-
- **Repository layer:** `/Users/sagit/.local/share/opencode/worktree/13650be91caa3a9e08a2e63127fef62757658384/mighty-nebula/go-backend/internal/store/repo/repository_mutations.go`
-  - CRUD operations for  - `resolveForwardIngress` function in `/Users/sagit/.local/share/opencode/worktree/13650be91caa3a9e08a2e63127fef62757658384/mighty-nebula/go-backend/internal/store/repo/repository.go`
-  - Computes `inIp` and `inPort` from joins
-
-### Current data model structure for forwards
-
-From `go-backend/internal/store/model/model.go`:
-
-```go
-// Forward maps to the "forward" table.
-type Forward struct {
-    ID          int64         `gorm:"primaryKey;autoIncrement"`
-    UserID      int64         `gorm:"column:user_id;not null"`
-    UserName    string        `gorm:"column:user_name;type:varchar(100);not null"`
-    Name        string        `gorm:"type:varchar(100);not null"`
-    TunnelID    int64         `gorm:"column:tunnel_id;not null"`
-    RemoteAddr  string        `gorm:"column:remote_addr;type:text;not null"`
-    Strategy    string        `gorm:"type:varchar(100);not null;default:'fifo'"`
-    InFlow      int64         `gorm:"not null;default:0"`
-    OutFlow     int64         `gorm:"column:out_flow;not null;default:0"`
-    CreatedTime int64         `gorm:"column:created_time;not null"`
-    UpdatedTime int64         `gorm:"column:updated_time;not null"`
-    Status      int           `gorm:"not null"`
-    Inx         int           `gorm:"not null;default:0"`
-    SpeedID     sql.NullInt64 `gorm:"column:speed_id"`
-}
-```
-
-```go
-// ForwardPort maps to the "forward_port" table - stores port assignments per entry node
-type ForwardPort struct {
-    ID        int64 `gorm:"primaryKey;autoIncrement"`
-    ForwardID int64 `gorm:"column:forward_id;not null"`
-    NodeID    int64 `gorm:"column:node_id;not null"`
-    Port      int   `gorm:"not null"`
-}
-```
-
-```go
-// Tunnel maps to the "tunnel" table - has entry IP configuration
-type Tunnel struct {
-    ID           int64          `gorm:"primaryKey;autoIncrement"`
-    Name         string         `gorm:"type:varchar(100);not null"`
-    TrafficRatio float64        `gorm:"column:traffic_ratio;not null;default:1.0"`
-    Type         int            `gorm:"not null"`
-    Protocol     string         `gorm:"type:varchar(10);not null;default:'tls'"`
-    Flow         int64          `gorm:"not null"`
-    CreatedTime  int64          `gorm:"column:created_time;not null"`
-    UpdatedTime  int64          `gorm:"column:updated_time;not null"`
-    Status       int            `gorm:"not null"`
-    InIP         sql.NullString `gorm:"column:in_ip;type:text"`       // Optional entry IP hint
-    Inx          int            `gorm:"not null;default:0"`
-    IPPreference string         `gorm:"column:ip_preference;type:varchar(10);not null;default:''"`
-}
-```
-
-### How entry listener is currently configured:
-
-1. **Port Storage**: `ForwardPort` table stores the mapping from `forward_id` -> `node_id` -> `port`
-   - Port is assigned by the handler or passed via `inPort` parameter ( or auto-picked)
-   - Entry nodes are determined by `tunnelEntryNodeIDs()` in handler
-
-3. **Entry IP Resolution**: The `resolveForwardIngress()` function resolves `inIp` and `inPort` by:
-   - Joining `forward_port` with `node` table
-   - `inIp` comes from `tunnel.in_ip` if set (takes precedence over node.server_ip)
-   - For multi-entry-node forwards, comma-separated IPs and ports are returned
-
-4. **Current IP-related fields**:
-   - `Forward` model: No `inIp` field (port is stored in `forward_port` table)
-   - `Tunnel` model: Has `InIP` field (nullable, - allows specifying of a preferred entry IP hint
-   - `UserForwardDetail` view struct ( joins tunnel table and includes `InIP` and `InPort`
-5. **No explicit entry IP selection UI in current dialog** - The port field is a text input, and form validates range but but UI doesn't allow setting specific IP addresses
@@ -1,10 +0,0 @@
-总结一下这个issue，结合当前代码，尽量设计简约实现issue的目标
-https://github.com/Sagit-chu/flvx/issues/211
-
---
-
-应该在节点上的高级里面允许添加多个IP
-
---
-
-继续，允许在节点管理里填写多个地址，然后在组成隧道或者转发的时候选择节点的时候允许选择具体的ip，请开始设计，允许使用并行subagent
@@ -1,76 +0,0 @@
-明白了！更新设计：
-
---
-
-## 最终设计方案
-
-### 核心需求
-
-| 场景 | 配置位置 | 选择内容 |
-|------|----------|----------|
-| 转发 | 转发创建/编辑 | 入口监听IP（从入口节点IP列表选择） |
-| 隧道 | 隧道配置 | 出口节点连接IP（从出口节点IP列表选择） |
-
---
-
-### 数据模型变更（3处）
-
-```
-Node.ExtraIPs      sql.NullString  `gorm:"column:extra_ips;type:text"`     // 逗号分隔
-ForwardPort.InIP   sql.NullString  `gorm:"column:in_ip;type:text"`         // 指定监听IP
-ChainTunnel.ConnectIP sql.NullString `gorm:"column:connect_ip;type:text"`  // 出口连接IP
-```
-
---
-
-### 改动清单
-
-#### 后端 (约200行)
-
-| 文件 | 改动 |
-|------|------|
-| `model/model.go` | Node/ForwardPort/ChainTunnel 增加3个字段 |
-| `repository_mutations.go` | CreateNode/UpdateNode 处理 extraIPs 参数 |
-| `repository_control.go` | GetNodeRecord/ListNodeAllIPs 辅助函数 |
-| `repository.go` | resolveForwardIngress 使用 forward_port.in_ip |
-| `handler/mutations.go` | selectTunnelDialHost 优先使用 connectIP |
-
-#### 前端 (约150行)
-
-| 页面 | 改动 |
-|------|------|
-| 节点编辑 | 高级配置增加"额外IP" Input（逗号分隔） |
-| 转发编辑 | 入口端口旁增加"监听IP" Select（从入口节点IP选择） |
-| 隧道配置 | 出口节点行增加"连接IP" Select（从出口节点IP选择） |
-
---
-
-### UI 示意
-
-**节点编辑 - 高级配置**
-```
-额外IP地址
-┌──────────────────────────────────────────┐
-│ 192.168.1.100, 10.0.0.5                  │
-└──────────────────────────────────────────┘
-用于多IP服务器，逗号分隔
-```
-
-**转发创建**
-```
-入口端口: [ 8080 ]     监听IP: [ 192.168.1.100 ▼ ]
-                                ├─ 203.0.113.10 (默认)
-                                ├─ 192.168.1.100
-                                └─ 10.0.0.5
-```
-
-**隧道配置 - 出口节点**
-```
-出口节点: [ node-1 ▼ ]  端口: [ 8443 ]  连接IP: [ 10.0.0.5 ▼ ]
-                                                ├─ 203.0.113.10 (默认)
-                                                └─ 10.0.0.5
-```
-
---
-
-这个方案简约清晰，是否可以开始实现？
@@ -1,4 +0,0 @@
-{
-  "enabled": true,
-  "telemetry": false
-}
@@ -1,48 +0,0 @@
-name: Publish Skill to npm
-
-on:
-  push:
-    tags:
-      - 'v*'
-  workflow_dispatch:
-
-jobs:
-  publish:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      id-token: write
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: '20'
-          registry-url: 'https://registry.npmjs.org'
-
-      - name: Get version from tag
-        id: version
-        run: |
-          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            VERSION=$(node -p "require('./skills/flvx-api/package.json').version")
-          else
-            VERSION="${GITHUB_REF#refs/tags/v}"
-          fi
-          echo "version=$VERSION" >> $GITHUB_OUTPUT
-          echo "Publishing skill version: $VERSION"
-
-      - name: Publish to npm
-        working-directory: skills/flvx-api
-        run: npm publish --provenance --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-
-      - name: Create GitHub Release
-        if: github.event_name == 'push'
-        uses: softprops/action-gh-release@v1
-        with:
-          name: Skill v${{ steps.version.outputs.version }}
-          generate_release_notes: true
-          files: skills/flvx-api/package.json
@@ -259,8 +259,6 @@ gitee/
 doraemon.jks
 device.id
 commit.sh
-.opencode/
-analysis/
 sql/
 !go-backend/internal/store/sqlite/sql/
 !go-backend/internal/store/sqlite/sql/schema.sql
@@ -268,6 +266,3 @@ sql/
 !go-backend/internal/store/postgres/sql/
 !go-backend/internal/store/postgres/sql/schema.sql
 !go-backend/internal/store/postgres/sql/data.sql
-go-backend/gost.db-shm
-.gitignore
-go-backend/gost.db-wal
@@ -1,33 +0,0 @@
-# Issue #211: 转发自定义监听IP / 隧道指定连接IP
-
-## 需求总结
-1. **节点**: 高级配置增加"额外IP地址"字段（逗号分隔）
-2. **转发**: 创建/编辑时可指定入口监听IP
-3. **隧道**: 配置出口节点时可指定连接IP
-
---
-
-## 任务清单
-
-### 后端
- [x] 1. 数据模型扩展 - Node/ForwardPort/ChainTunnel 增加字段
- [x] 2. Repository - CreateNode/UpdateNode 处理 extraIPs
- [x] 3. Repository - resolveForwardIngress 使用 forward_port.in_ip
- [x] 4. Repository - GetNodeAllIPs 辅助函数（返回节点所有可用IP）
- [x] 5. Handler - 转发创建/更新处理 inIp 参数
- [x] 6. Handler - 隧道出口节点处理 connectIp 参数
- [x] 7. Handler - 节点API返回 extraIPs 字段
-
-### 前端
- [x] 8. 节点编辑页 - 高级配置增加"额外IP"输入
- [x] 9. 转发编辑弹窗 - 增加"监听IP"下拉选择
- [x] 10. 隧道配置页 - 出口节点增加"连接IP"输入
-
---
-
-## 完成进度
- 开始时间: 2026-03-02
- 完成时间: 2026-03-02
- 完成任务: 10/10
- 后端完成: ✅
- 前端完成: ✅
@@ -1,27 +1,24 @@
 # PROJECT KNOWLEDGE BASE

-**Generated:** Thu Feb 26 2026
-**Commit:** 21008cc
+**Generated:** Sun Feb 15 2026
+**Commit:** e5e22ba
 **Branch:** main
-**Tag:** 2.1.5-rc15

 ## OVERVIEW
-FLVX (formerly Flux Panel) is a traffic forwarding management system built on a forked GOST v3 stack. It ships as a Go-based admin API (SQLite/PostgreSQL) + Vite/React UI + Go forwarding agent, with optional mobile WebView wrappers.
+FLVX (formerly Flux Panel) is a traffic forwarding management system built on a forked GOST v3 stack. It ships as a Go-based admin API (SQLite) + Vite/React UI + Go forwarding agent, with optional mobile WebView wrappers.

 ## STRUCTURE
 ```
 ./
 ├── go-gost/               # Go forwarding agent (forked gost + local x/)
 │   └── x/                 # Local fork of github.com/go-gost/x (replace => ./x)
-├── go-backend/            # Go Admin API (GORM + SQLite/PostgreSQL, net/http)
-│   └── tests/contract/    # Integration/contract tests
-├── vite-frontend/         # React/Vite dashboard (shadcn bridge + Tailwind v4)
-│   └── src/shadcn-bridge/heroui/  # HeroUI-compatible facade
+├── go-backend/            # Go Admin API (SQLite, net/http)
+├── vite-frontend/         # React/Vite dashboard (HeroUI + Tailwind)
 ├── docker-compose-v4.yml  # Panel deploy (IPv4-only bridge)
 ├── docker-compose-v6.yml  # Panel deploy (IPv6-enabled bridge)
 ├── panel_install.sh       # Panel installer/upgrader (downloads compose)
 ├── install.sh             # Node installer/upgrader (downloads gost binary)
-└── .github/workflows/     # CI: build/test + Docker push + release artifacts
+└── .github/workflows/     # CI: build/push images + release artifacts
 ```

 ## WHERE TO LOOK
@@ -31,15 +28,10 @@ FLVX (formerly Flux Panel) is a traffic forwarding management system built on a
 | **Deploy (IPv6)** | `docker-compose-v6.yml` | Same as v4 + IPv6-enabled bridge |
 | **Panel install** | `panel_install.sh` | Picks v4/v6, generates `JWT_SECRET`, downloads compose |
 | **Node install** | `install.sh` | Installs `/etc/flux_agent/flux_agent` + writes `config.json`/`gost.json` + systemd `flux_agent.service` |
-| **Admin API** | `go-backend/` | Go Admin API (SQLite/PostgreSQL) |
-| **Web UI** | `vite-frontend/` | React/Vite dashboard (shadcn bridge + Tailwind v4) |
-| **UI Compatibility** | `vite-frontend/src/shadcn-bridge/heroui/` | HeroUI-compatible API wrappers backed by shadcn/radix |
-| **Theme Tokens** | `vite-frontend/src/styles/tailwind-theme.pcss` | Tailwind v4 `@theme inline` semantic color mapping |
+| **Admin API** | `go-backend/` | Go Admin API (SQLite) |
+| **Web UI** | `vite-frontend/` | React/Vite dashboard (HeroUI + Tailwind) |
 | **Go Agent** | `go-gost/` | Forwarding agent (forked gost + local x/) |
 | **Go Core** | `go-gost/x/` | Handlers/listeners/dialers + management API |
-| **Repository Layer** | `go-backend/internal/store/repo/` | GORM data access (repository.go 83k LOC) |
-| **Contract Tests** | `go-backend/tests/contract/` | Integration tests for auth, federation, tunnels |
-| **CI Workflows** | `.github/workflows/` | ci-build.yml, docker-build.yml, deploy-docs.yml |

 ## CODE MAP
 | Symbol | Type | Location | Role |
@@ -48,28 +40,20 @@ FLVX (formerly Flux Panel) is a traffic forwarding management system built on a
 | `main` | Func | `go-backend/cmd/paneld/main.go` | Backend Entry |
 | `App` | Component | `vite-frontend/src/App.tsx` | Frontend Entry |
 | `main` | Func | `go-gost/main.go` | Agent Entry |
-| `Repository` | Struct | `go-backend/internal/store/repo/repository.go` | Data Access Layer |
-| `Handler` | Struct | `go-backend/internal/http/handler/handler.go` | HTTP Handlers |
-| `websocket_reporter` | Func | `go-gost/x/socket/websocket_reporter.go` | Panel Telemetry |
+

 ## CONVENTIONS
 - **Auth**: `Authorization` header carries the raw JWT token (no `Bearer` prefix) between `vite-frontend/` and `go-backend/`.
 - **Module Fork**: `go-gost/` uses `replace github.com/go-gost/x => ./x` and `go-gost/x/` is also its own Go module.
 - **Encryption**: Agent-to-panel communication uses AES encryption with node `secret` as PSK.
 - **API Envelope**: All REST responses follow `{code, msg, data, ts}` structure (code 0 = success).
- **Frontend UI Layer**: Import UI primitives from `src/shadcn-bridge/heroui/*` (legacy-compatible facade), not direct `@heroui/*` packages.
- **Tailwind v4 Semantic Colors**: `src/styles/globals.css` must import `src/styles/tailwind-theme.pcss`; removing it breaks semantic classes like `bg-primary`, `text-foreground`, and `border-input`.
- **Go Versions**: `go-backend` uses Go 1.24, `go-gost` uses Go 1.23, `go-gost/x` uses Go 1.22.

 ## ANTI-PATTERNS (THIS PROJECT)
 - **DO NOT EDIT** generated protobuf output: `go-gost/x/internal/util/grpc/proto/*.pb.go`, `go-gost/x/internal/util/grpc/proto/*_grpc.pb.go`.
 - **DO NOT ADD** `Bearer` prefix to Authorization header - expects raw JWT token.
 - **DO NOT MODIFY** `install.sh` or `panel_install.sh` locally - CI overwrites these on release.
- **DO NOT** let backend handlers call `repo.DB()` directly — add a Repository method instead.
+- **DO NOT USE** ORM in backend - uses raw SQL with `database/sql`.
 - **DO NOT ADD** frontend tests - project has no test infrastructure (Vitest/Jest not configured).
- **DO NOT REINTRODUCE** `@heroui/*` or `@nextui-org/*` dependencies; migration is now shadcn bridge-based.
- **DO NOT** use `type:jsonb` or `type:serial` in GORM tags (SQLite incompatible).
- **DO NOT** omit `TableName()` on new models — GORM pluralizes by default.

 ## COMMANDS
 ```bash
@@ -85,21 +69,15 @@ docker compose -f docker-compose-v6.yml up -d
 (cd go-backend && make build)
 (cd vite-frontend && npm run dev)
 (cd go-gost && go run .)
-
-# Testing
-(cd go-backend && go test ./...)
-(cd go-backend && go test ./tests/contract/...)
 ```

 ## UNIQUE STYLES
 - **Flat Monorepo**: Language-prefixed dirs (`go-backend`, `go-gost`, `vite-frontend`) instead of `apps/`/`libs/`.
 - **Asymmetric Go Layout**: `go-backend` follows `cmd/<app>/main.go` while `go-gost` uses `root/main.go`.
 - **Frontend Hybrid Mode**: `App.tsx` detects "H5 mode" (mobile WebView) vs desktop, dictating layout strategy.
- **Experimental Bundler**: `vite-frontend` uses `rolldown-vite` (Rust-based) instead of standard Vite.
- **Non-minified Builds**: `vite.config.ts` sets `minify: false`, `treeshake: false` for debugging.

 ## NOTES
- LSP servers are not installed in this environment (gopls/typescript-language-server); rely on grep-based navigation.
+- LSP servers are not installed in this environment (gopls/jdtls/typescript-language-server); rely on grep-based navigation.
 - `vite-frontend/vite.config.ts` sets `minify: false` and disables treeshake; expect larger bundles.
 - `vite-frontend` uses `rolldown-vite` (experimental Rust bundler) instead of standard Vite.
 - Install scripts (`install.sh`, `panel_install.sh`) self-delete after execution - common pattern in one-liner installs.
@@ -107,16 +85,5 @@ docker compose -f docker-compose-v6.yml up -d
 - CI dynamically injects `PINNED_VERSION` into install scripts and docker-compose files during releases.
 - `panel_install.sh` auto-detects IPv6 and modifies `/etc/docker/daemon.json` to enable IPv6 bridge.
 - Download proxy `https://gcode.hostcentral.cc/` used for GitHub downloads in China/restricted environments.
- Backend has contract tests in `go-backend/tests/contract/` - frontend has no test infrastructure.
+- Backend has contract tests in `go-backend/tests/contract/` - frontend has no test infrastructure (Vitest/Jest not configured).
 - `analysis/3x-ui/` contains a separate git repo for reference/comparison - not part of FLVX core.
- CI workflows: `ci-build.yml` (build check), `docker-build.yml` (multi-arch images + release), `deploy-docs.yml` (MkDocs).
- PostgreSQL migration supported via `panel_install.sh` menu option using pgloader.
- Repository layer is large: `repository.go` (83k LOC), `repository_mutations.go` (43k LOC).
- Button visual parity relies on `vite-frontend/src/shadcn-bridge/heroui/button.tsx` color mapping + `vite-frontend/src/styles/tailwind-theme.pcss` token export.
-
-## PLAN DOCUMENT RULE
- Every new implementation plan must have a dedicated Markdown plan document.
- Store plan documents under `plans/`.
- Use an incrementing numeric prefix and a short plan-summary name: `NNN-<plan-summary>.md` (for example, `001-auth-refactor.md`, `002-federation-api-cleanup.md`).
- The numeric prefix must increase by 1 for each new plan.
- In each plan document, keep a task checklist and mark each task as completed immediately after finishing it.
@@ -1,148 +0,0 @@
-# 限速功能重构实施计划
-
-## 一、需求概述
-
-**原始需求**: 限速功能当前绑定到具体隧道，需要改为不绑定隧道，创建限速后可以自由在隧道上限速，也可以在转发上限速。
-
-**核心变更**:
-1. 限速规则(SpeedLimit)与隧道的绑定关系改为可选
-2. 转发(Forward)支持独立的限速规则
-
---
-
-## 二、实施计划清单
-
-### 2.0 计划状态（审计更新：2026-02-26）
-
- 总体状态：**进行中（未验收通过）**
- 已完成：模型、仓储查询、限速 CRUD、控制面优先级、限速页与类型改造、编译与测试通过
- 未完成：**Forward 独立限速写入链路**（前端表单 -> API handler -> repository 落库 `forward.speed_id`）
-
-### 2.1 后端模型层 (Model)
-
-| 序号 | 任务 | 文件 | 状态 |
-|------|------|------|------|
-| M1 | SpeedLimit.TunnelID 改为 sql.NullInt64 (可空) | `go-backend/internal/store/model/model.go` | ✅ 完成 |
-| M2 | SpeedLimit.TunnelName 改为 sql.NullString (可空) | `go-backend/internal/store/model/model.go` | ✅ 完成 |
-| M3 | Forward 添加 SpeedID sql.NullInt64 字段 | `go-backend/internal/store/model/model.go` | ✅ 完成 |
-| M4 | ForwardRecord 添加 SpeedID sql.NullInt64 字段 | `go-backend/internal/store/model/model.go` | ✅ 完成 |
-| M5 | SpeedLimitBackup.TunnelID 改为指针类型 | `go-backend/internal/store/model/model.go` | ✅ 完成 |
-| M6 | ForwardBackup 添加 SpeedID *int64 字段 | `go-backend/internal/store/model/model.go` | ✅ 完成 |
-
-### 2.2 后端仓储层 (Repository)
-
-| 序号 | 任务 | 文件 | 状态 |
-|------|------|------|------|
-| R1 | ListSpeedLimits() 返回可空 tunnelId/tunnelName | `go-backend/internal/store/repo/repository.go` | ✅ 完成 |
-| R2 | ListForwards() 返回 speedId 字段 | `go-backend/internal/store/repo/repository.go` | ✅ 完成 |
-| R3 | CreateSpeedLimit() 参数 tunnelID 改为 *int64 | `go-backend/internal/store/repo/repository_mutations.go` | ✅ 完成 |
-| R4 | UpdateSpeedLimit() 参数 tunnelID 改为 *int64 | `go-backend/internal/store/repo/repository_mutations.go` | ✅ 完成 |
-| R5 | GetSpeedLimitTunnelID() 返回 sql.NullInt64 | `go-backend/internal/store/repo/repository_mutations.go` | ✅ 完成 |
-| R6 | exportSpeedLimits() 处理可空字段 | `go-backend/internal/store/repo/repository.go` | ✅ 完成 |
-| R7 | importSpeedLimits() 处理可空字段 | `go-backend/internal/store/repo/repository.go` | ✅ 完成 |
-| R8 | GetSpeedLimitSpeed() 新增方法 | `go-backend/internal/store/repo/repository_flow.go` | ✅ 完成 |
-| R9 | ListForwardsByTunnel() 返回 SpeedID | `go-backend/internal/store/repo/repository_control.go` | ✅ 完成 |
-| R10 | ListActiveForwardsByUser() 返回 SpeedID | `go-backend/internal/store/repo/repository_flow.go` | ✅ 完成 |
-| R11 | ListActiveForwardsByUserTunnel() 返回 SpeedID | `go-backend/internal/store/repo/repository_flow.go` | ✅ 完成 |
-| R12 | GetForwardRecord() 返回 SpeedID | `go-backend/internal/store/repo/repository_flow.go` | ✅ 完成 |
-
-### 2.3 后端处理器层 (Handler)
-
-| 序号 | 任务 | 文件 | 状态 |
-|------|------|------|------|
-| H1 | speedLimitCreate 处理可选 tunnelId | `go-backend/internal/http/handler/mutations.go` | ✅ 完成 |
-| H2 | speedLimitUpdate 处理可选 tunnelId | `go-backend/internal/http/handler/mutations.go` | ✅ 完成 |
-| H3 | speedLimitDelete 处理可空 tunnelID | `go-backend/internal/http/handler/mutations.go` | ✅ 完成 |
-
-### 2.4 后端控制平面 (Control Plane)
-
-| 序号 | 任务 | 文件 | 状态 |
-|------|------|------|------|
-| C1 | syncForwardServices 优先使用 Forward.SpeedID | `go-backend/internal/http/handler/control_plane.go` | ✅ 完成 |
-| C2 | 回退到 UserTunnel 的 speed limit | `go-backend/internal/http/handler/control_plane.go` | ✅ 完成 |
-
-### 2.5 前端类型定义 (TypeScript Types)
-
-| 序号 | 任务 | 文件 | 状态 |
-|------|------|------|------|
-| T1 | SpeedLimitApiItem.tunnelId 改为可选 | `vite-frontend/src/api/types.ts` | ✅ 完成 |
-| T2 | ForwardApiItem 添加 speedId 字段 | `vite-frontend/src/api/types.ts` | ✅ 完成 |
-| T3 | ForwardMutationPayload 添加 speedId 字段 | `vite-frontend/src/api/types.ts` | ✅ 完成 |
-| T4 | SpeedLimitMutationPayload.tunnelId 改为可选 | `vite-frontend/src/api/types.ts` | ✅ 完成 |
-
-### 2.6 前端页面组件
-
-| 序号 | 任务 | 文件 | 状态 |
-|------|------|------|------|
-| F1 | SpeedLimitRule 接口更新 | `vite-frontend/src/pages/limit.tsx` | ✅ 完成 |
-| F2 | SpeedLimitForm 接口更新 | `vite-frontend/src/pages/limit.tsx` | ✅ 完成 |
-| F3 | validateForm 移除 tunnelId 必填校验 | `vite-frontend/src/pages/limit.tsx` | ✅ 完成 |
-| F4 | Select 组件改为可选 | `vite-frontend/src/pages/limit.tsx` | ✅ 完成 |
-| F5 | 显示"未绑定"状态 | `vite-frontend/src/pages/limit.tsx` | ✅ 完成 |
-
-### 2.7 编译验证
-
-| 序号 | 任务 | 状态 |
-|------|------|------|
-| B1 | Go 后端编译通过 | ✅ 完成 |
-| B2 | TypeScript 类型检查通过 | ✅ 完成 |
-| B3 | `go test ./...` 全量通过 | ✅ 完成 |
-| B4 | `go test ./tests/contract/... -run SpeedLimit` 通过 | ✅ 完成 |
-
-### 2.8 Forward 独立限速写入链路补全（新增）
-
-| 序号 | 任务 | 文件 | 状态 |
-|------|------|------|------|
-| N1 | forwardCreate 支持接收并校验可选 speedId，写入 Forward.SpeedID | `go-backend/internal/http/handler/mutations.go` | ✅ 完成 |
-| N2 | forwardUpdate 支持更新/清空 speedId，并触发服务重下发 | `go-backend/internal/http/handler/mutations.go` | ✅ 完成 |
-| N3 | CreateForwardTx 支持落库 speed_id | `go-backend/internal/store/repo/repository_mutations.go` | ✅ 完成 |
-| N4 | UpdateForward 支持更新 speed_id | `go-backend/internal/store/repo/repository_mutations.go` | ✅ 完成 |
-| N5 | Forward 页面新增限速选择并透传 speedId | `vite-frontend/src/pages/forward.tsx` | ✅ 完成 |
-| N6 | Forward 相关契约测试补充 speedId 写入/清空断言 | `go-backend/tests/contract/forward_contract_test.go` | ✅ 完成 |
-
---
-
-## 三、优先级说明
-
-限速规则应用优先级:
-1. **Forward.SpeedID** - 转发级别的限速 (最高优先)
-2. **UserTunnel.SpeedID** - 用户隧道权限级别的限速 (回退)
-
---
-
-## 四、数据库兼容性
-
- SpeedLimit 表: `tunnel_id` 和 `tunnel_name` 字段改为可空 (GORM AutoMigrate 自动处理)
- Forward 表: 新增 `speed_id` 可空字段 (GORM AutoMigrate 自动处理)
-
---
-
-## 五、验证检查项
-
-### 5.1 功能验证（审计后）
-
- [x] 创建不限速规则的限速 (不绑定隧道)
- [x] 创建绑定隧道的限速 (兼容旧逻辑)
- [x] 编辑限速规则，切换隧道绑定状态
- [ ] 删除限速规则
- [ ] 转发列表正确显示 speedId
-
-### 5.2 API 验证（审计后）
-
- [x] GET /api/speed-limit/list 返回可选 tunnelId
- [x] POST /api/speed-limit/create 接受可选 tunnelId
- [x] POST /api/speed-limit/update 接受可选 tunnelId
- [ ] GET /api/forward/list 返回 speedId
-
-### 5.3 兼容性验证（审计后）
-
- [x] 现有绑定隧道的限速规则继续正常工作
- [ ] 现有 UserTunnel 的限速继续正常工作
- [ ] 备份/恢复功能正常
-
-### 5.4 Forward 独立限速闭环验证（新增）
-
- [x] POST /api/forward/create 接受 speedId 并写入 `forward.speed_id`
- [x] POST /api/forward/update 可更新/清空 speedId
- [x] Forward 表单可选择限速并提交 speedId
- [ ] `syncForwardServices` 实际使用 Forward.SpeedID 而非仅回退 UserTunnel.SpeedID
@@ -129,28 +129,27 @@ docker compose up -d
 - **License**: Apache License 2.0

 ## Modifications
-This fork (FLVX) is no longer a light patch on top of the upstream project. It has been deeply reworked, with both backend and frontend rebuilt around a Go-based architecture.
+The following major changes and additions have been made in this fork (FLVX):

-### 1. Backend (Rewritten)
- **Removed**: The original `springboot-backend/` (Java/Spring Boot) implementation.
- **Added**: A fully rewritten `go-backend/` service (Go), including updated data and API handling for panel management.
+### 1. Backend Architecture (Replaced)
+- **Removed**: The original `springboot-backend/` (Java/Spring Boot) has been entirely removed.
+- **Added**: A new `go-backend/` (Go/SQLite) implementation replaces the original backend.

-### 2. Frontend (Reworked)
- **Reworked**: `vite-frontend/` has been substantially rebuilt to match the new backend contract and current UI layer architecture.
- **Updated**: Dashboard pages/components and interaction flows for the current React/Vite stack.
+### 2. Forwarding Agent (Modified)
+- **Modified**: `go-gost/` - Modified forwarding agent wrapper.
+- **Modified**: `go-gost/x/` - Modified local fork of the `gost` extensions library.

-### 3. Forwarding Stack (Modified)
- **Modified**: `go-gost/` forwarding agent wrapper.
- **Modified**: `go-gost/x/` local fork of `github.com/go-gost/x`.
+### 3. Frontend (Modified)
+- **Modified**: `vite-frontend/` - Significant updates to the React/Vite dashboard to compatible with the new Go backend, including UI/UX improvements (HeroUI + Tailwind).

-### 4. Mobile Clients (Removed)
- **Removed**: `android-app/` source code.
- **Removed**: `ios-app/` source code.
+### 4. Mobile Applications (Removed)
+- **Removed**: `android-app/` - Source code for the Android client.
+- **Removed**: `ios-app/` - Source code for the iOS client.

-### 5. Deployment & Project Infrastructure
- **Updated**: Docker deployment templates and installer output flow (IPv4/IPv6 compose variants).
- **Updated**: Release installation scripts (`install.sh`, `panel_install.sh`) and supporting automation.
- **Added/Updated**: Project-level engineering documentation (for example `AGENTS.md`).
+### 5. Infrastructure & Scripts
+- **Modified**: `docker-compose.yml` (installer output name, auto-selects IPv4/IPv6 template, updated for Go backend).
+- **Modified**: `install.sh`, `panel_install.sh` (Updated installation logic).
+- **Added**: `AGENTS.md` (Project documentation).

 ---

@@ -1,220 +0,0 @@
-# AI Skill 使用指南
-
-让大模型直接操作 FLVX 面板的技能包。支持 OpenCode、OpenClaw、Claude Code 等工具。
-
-## 安装
-
-### 方式 1: npm (推荐)
-
-```bash
-npm install -g @flvx/skill-api
-```
-
-postinstall 脚本会自动链接到 `~/.agents/skills/flvx-api/`。
-
-### 方式 2: 手动链接
-
-```bash
-# 从 FLVX 源码
-cd /path/to/flvx
-mkdir -p ~/.agents/skills
-ln -sf $(pwd)/skills/flvx-api ~/.agents/skills/
-
-# 或从 GitHub
-git clone https://github.com/Sagit-chu/flvx.git
-cd flvx
-ln -sf $(pwd)/skills/flvx-api ~/.agents/skills/
-```
-
-## 配置
-
-设置环境变量：
-
-```bash
-export FLVX_BASE_URL="https://your-panel.example.com"
-export FLVX_USERNAME="admin"
-export FLVX_PASSWORD="your-password"
-```
-
-或使用凭证文件：
-
-```bash
-mkdir -p ~/.flvx
-cat > ~/.flvx/.env << 'EOF'
-export FLVX_BASE_URL="https://panel.example.com"
-export FLVX_USERNAME="admin"
-export FLVX_PASSWORD="your-password"
-EOF
-chmod 600 ~/.flvx/.env
-source ~/.flvx/.env
-```
-
---
-
-## 工具接入方法
-
-### OpenCode
-
-OpenCode 是命令行 AI 编程助手，支持通过 skills 扩展能力。
-
-**安装 skill:**
-```bash
-npm install -g @flvx/skill-api
-```
-
-**使用:**
-```bash
-export FLVX_BASE_URL="https://panel.example.com"
-export FLVX_USERNAME="admin"
-export FLVX_PASSWORD="your-password"
-
-opencode
-```
-
-**示例对话:**
-```
-你: 查看我的转发列表
-你: 创建一个转发到 192.168.1.100:80 使用隧道 1
-你: 检查节点状态
-你: 查看流量使用情况
-```
-
---
-
-### OpenClaw
-
-OpenClaw 同样支持 skills 机制。
-
-**安装 skill:**
-```bash
-npm install -g @flvx/skill-api
-
-# 或手动链接
-mkdir -p ~/.openclaw/skills
-ln -sf /path/to/flvx/skills/flvx-api ~/.openclaw/skills/flvx-api
-```
-
-**使用:**
-```bash
-openclaw
-
->>> 查看所有节点状态
->>> 给用户 alice 分配 50GB 流量
->>> 导出系统备份
-```
-
---
-
-### Claude Code
-
-Claude Code 是 Anthropic 官方的命令行工具，支持通过 CLAUDE.md 扩展。
-
-#### 方式 1: 项目级 CLAUDE.md
-
-在项目根目录创建 `CLAUDE.md`：
-
-```markdown
-# FLVX API Skill
-
-你可以通过 REST API 操作 FLVX 面板。
-
-## 环境变量
- FLVX_BASE_URL: 面板地址
- FLVX_USERNAME: 用户名
- FLVX_PASSWORD: 密码
-
-## 认证规则
- Authorization 头使用原始 JWT token，不加 "Bearer " 前缀
- 所有 API 使用 POST 方法
-
-## 常用 API
-
-### 登录获取 token
-POST /api/v1/user/login
-{"username": "...", "password": "..."}
-
-### 查看转发列表
-POST /api/v1/forward/list
-Authorization: <token>
-{}
-
-### 创建转发
-POST /api/v1/forward/create
-{"name": "xxx", "tunnelId": 1, "remoteAddr": "1.2.3.4:80"}
-
-### 查看节点
-POST /api/v1/node/list
-{}
-```
-
-**使用:**
-```bash
-cd /path/to/your/project
-claude
-```
-
-#### 方式 2: 全局 CLAUDE.md
-
-```bash
-mkdir -p ~/.claude
-cat > ~/.claude/CLAUDE.md << 'EOF'
-# FLVX Panel Operations
-
-使用 FLVX REST API 操作流量转发面板。
-
-环境变量: FLVX_BASE_URL, FLVX_USERNAME, FLVX_PASSWORD
-调用方式: curl -X POST "$FLVX_BASE_URL/api/v1/..." -H "Authorization: $TOKEN"
-注意: Authorization 不要加 Bearer 前缀
-EOF
-```
-
-#### 方式 3: 复制 SKILL.md
-
-```bash
-cat ~/.agents/skills/flvx-api/SKILL.md >> ~/.claude/CLAUDE.md
-```
-
-**示例对话:**
-```
->>> 帮我查看 FLVX 面板上有哪些节点
->>> 创建一个名为 test 的转发，目标地址 10.0.0.1:80
->>> 查看我的流量使用情况
-```
-
---
-
-## API 覆盖
-
-| 模块 | 操作 |
-|------|------|
-| 认证 | 登录、Token 管理 |
-| 用户 | 增删改查、流量重置、密码 |
-| 节点 | 增删改查、安装、升级、状态 |
-| 隧道 | 增删改查、用户分配 |
-| 转发 | 增删改查、暂停/恢复、诊断 |
-| 分组 | 用户/隧道分组、权限 |
-| 限速 | 增删改查 |
-| 联邦 | 节点共享、远程节点 |
-| 备份 | 导出/导入 |
-
-## 安全提示
-
- ⚠️ 环境变量在进程列表中可见
- 使用 `~/.flvx/.env` 文件并设置 `chmod 600`
- 添加 `export HISTIGNORE="*FLVX_PASSWORD*"` 防止密码进入历史记录
- Token 仅在会话内存中缓存，不写入磁盘
-
-## 发布
-
-维护者可通过以下方式发布新版本：
-
-```bash
-# 方式 1: 推送 tag
-git tag skill-v2.1.6
-git push --tags
-
-# 方式 2: GitHub Actions 手动触发
-# 在 Actions 页面运行 publish-skill workflow
-```
-
-需要在 GitHub 仓库设置 `NPM_TOKEN` secret。
@@ -18,7 +18,6 @@
 - [安装部署](./install.md)
 - [使用指南](./usage.md)
 - [PostgreSQL 数据库指南](./postgresql.md)
- [AI Skill 接入](./ai-skill.md) - 让大模型直接操作面板
 - [常见问题](./faq.md)

 ## 免责声明
@@ -2,7 +2,7 @@

 ## OVERVIEW
 Go-based Admin API for FLVX. Replaced legacy Spring Boot backend.
-**Stack:** Go 1.24, net/http (std lib), GORM + SQLite/PostgreSQL (glebarez/sqlite - CGO-free).
+**Stack:** Go 1.23, net/http (std lib), SQLite/PostgreSQL (modernc.org/sqlite - CGO-free).

 ## STRUCTURE
 ```
@@ -14,18 +14,12 @@ go-backend/
 │   │   ├── handler/          # API Handlers (User, Tunnel, Node, etc.)
 │   │   ├── middleware/       # JWT, CORS, Logging, Recover
 │   │   └── response/         # JSON response helpers
-│   ├── store/
-│   │   ├── model/model.go    # GORM model structs (single source of truth)
-│   │   └── repo/             # Data Access Layer (Repository pattern, GORM)
-│   │       ├── repository.go           # Core queries, Open/OpenPostgres, AutoMigrate (83k LOC)
-│   │       ├── repository_mutations.go # Mutation helpers (user/node/tunnel/forward CRUD, 43k LOC)
-│   │       ├── repository_federation.go # Federation-specific queries
-│   │       ├── repository_flow.go      # Flow/forward status queries
-│   │       ├── repository_control.go   # Control plane queries
-│   │       └── repository_groups.go    # Group management queries
+│   ├── store/sqlite/         # Data Access Layer (Repository pattern)
+│   │   ├── repository.go     # SQL queries & Struct definitions
+│   │   └── sql/              # Embedded schema.sql & data.sql
 │   └── auth/                 # Auth logic
-├── tests/contract/            # Integration/contract tests (14 tests)
-├── Dockerfile                # Multi-stage build (golang:1.24-bookworm → debian:bookworm-slim)
+├── tests/                    # Integration/Contract tests
+├── Dockerfile                # Multi-stage build (alpine)
 └── Makefile                  # Build commands
 ```

@@ -33,35 +27,28 @@ go-backend/
 | Task | Location | Notes |
 |------|----------|-------|
 | **API Routes** | `go-backend/internal/http/router.go` | Registers handlers to `http.ServeMux` |
-| **DB Models** | `go-backend/internal/store/model/model.go` | GORM structs with `TableName()` methods |
-| **Repository** | `go-backend/internal/store/repo/` | GORM-based queries, all DB ops encapsulated |
+| **DB Schema** | `go-backend/internal/store/sqlite/sql/schema.sql` | Embedded in binary |
+| **SQL Queries** | `go-backend/internal/store/sqlite/repository.go` | Raw SQL, no ORM |
 | **Auth Middleware** | `go-backend/internal/http/middleware/jwt.go` | Extracts `Authorization` header |
 | **WebSocket** | `go-backend/internal/ws/` | Real-time updates (traffic, status) |
-| **Contract Tests** | `go-backend/tests/contract/` | Integration tests for auth, federation, tunnels |

 ## CONVENTIONS
- **GORM ORM**: Uses GORM with `glebarez/sqlite` (CGO-free) and `gorm.io/driver/postgres`.
- **AutoMigrate**: Schema created at startup via `autoMigrateAll()` — no hand-written DDL.
- **TableName()**: All models define explicit `TableName()` returning singular snake_case names.
- **Repository Pattern**: Handlers never access `*gorm.DB` directly — all queries go through `repo.Repository` methods.
+- **No ORM**: Uses raw SQL with `database/sql` and `modernc.org/sqlite`.
+- **CGO-Free SQLite**: `modernc.org/sqlite` instead of `mattn/go-sqlite3` - builds without CGO.
 - **Standard Lib**: Uses `net/http` for routing (Go 1.22+ patterns).
 - **Auth**: Expects raw JWT in `Authorization` header (no `Bearer` prefix).
 - **API Envelope**: All responses use `response.R{code, msg, data, ts}` structure.
 - **Config**: Loaded from environment variables (see `cmd/paneld/main.go`).
- **SQLite Constraints**: `MaxOpenConns(1)`, WAL mode, busy_timeout=5000.
- **PostgreSQL**: Supported via `DB_TYPE=postgres` and `DATABASE_URL` env vars.
+- **SQL Idempotency**: Prefer `ON CONFLICT DO NOTHING` for inserts in migrations/sync.

 ## ANTI-PATTERNS
- **DO NOT** let handlers call `repo.DB()` directly — add a Repository method instead.
+- **DO NOT USE** ORM - uses raw SQL throughout.
 - **DO NOT CHANGE** handler signatures without updating `router.go`.
- **DO NOT** use `type:jsonb` or `type:serial` in GORM tags (SQLite incompatible).
- **DO NOT** omit `TableName()` on new models — GORM pluralizes by default.

 ## COMMANDS
 ```bash
 cd go-backend
 go run ./cmd/paneld       # Default: SERVER_ADDR=:6365
-go test ./...             # Unit tests
-go test ./tests/contract/... # Contract tests
+go test ./...
 make build
 ```
@@ -1,536 +0,0 @@
-# 数据库 GORM ORM 迁移计划
-
-**创建时间:** 2026-02-15
-**更新时间:** 2026-02-17 (实施：完成 P1 + P2 + P3 + P5(Repo 查询层 + schema 收尾) + 测试/构建收尾)
-**分支:** main (commit e5e22ba)
-**状态:** 基本完成（保留 4 处 PG 序列修复 DDL `Exec`）
-
---
-
-## 一、现状分析
-
-### 1.1 迁移前架构 (已归档)
-
-项目原使用 `database/sql` + 手写 raw SQL，通过 `internal/store/db.go` 中的运行时 SQL 重写层实现 SQLite/PostgreSQL 双数据库兼容。
-
-| 组件 | 行数 | 角色 | 当前状态 |
-|------|------|------|----------|
-| `store/db.go` | ~520 | SQL 方言重写层 | **已删除** |
-| `store/sqlite/repository.go` | ~3118 | Repository 查询方法 | **已重写为 store/repo/** |
-| `handler/mutations.go` | ~3748 | Handler 内直接写 raw SQL | **已迁移到 repo（生产 SQL=0）** |
-| `handler/handler.go` | ~1283 | 部分方法用 `repo.DB()` | **大部分已迁移** |
-| `handler/federation.go` | ~若干 | Federation 相关 SQL | **已迁移到 repo** |
-| `handler/control_plane.go` | ~若干 | 控制面相关 SQL | **已迁移到 repo** |
-| `handler/flow_policy.go` | ~若干 | 流量策略相关 SQL | **已迁移到 repo** |
-| `handler/jobs.go` | ~若干 | 后台任务相关 SQL | **已迁移到 repo** |
-| `store/postgres/` | 目录 | PostgreSQL 专用 schema/data | **已删除** |
-
-### 1.2 痛点 (迁移目标)
-
-1. ~~**双 Schema 维护**~~：已通过 AutoMigrate 解决
-2. ~~**SQL 重写层复杂**~~：db.go 已删除
-3. ~~**handler 直接写 SQL**~~：`mutations.go` 生产路径 `tx.Exec`/`tx.Raw` 已清零（测试代码除外）
-4. ~~**无类型安全**~~：repo 业务查询已 GORM 化；剩余 4 处为 PG 序列修复 DDL `Exec`（设计保留）
-5. ~~**模型定义分散**~~：已集中到 model/model.go
-
---
-
-## 二、方案：引入 GORM ORM（全面重写）
-
-### 2.1 方案变更说明
-
-原计划为 **方案 D（扩展现有 DDL 重写层）**，现变更为 **方案 A（GORM 全面重写）**。
-
-### 2.2 选择 GORM 的理由
-
-1. Go 生态最成熟的 ORM，社区庞大，文档完善
-2. 原生支持 SQLite + PostgreSQL 双数据库，自动处理方言差异
-3. AutoMigrate 消除双 schema 维护，自动处理 AUTOINCREMENT ↔ SERIAL 等
-4. 类型安全的模型定义，编译期检查字段映射
-5. 内置事务管理（closure pattern 自动 rollback/commit）
-6. 自动处理 `"user"` 保留字引号
-
-### 2.3 GORM 驱动选择
-
-| 数据库 | 驱动 | 包 | 备注 |
-|--------|------|-----|------|
-| SQLite | modernc.org/sqlite (CGO-free) | `github.com/glebarez/sqlite` | 纯 Go，无需 CGO |
-| PostgreSQL | pgx/v5 | `gorm.io/driver/postgres` | 默认使用 pgx |
-
-> **注意**：标准 `gorm.io/driver/sqlite` 依赖 CGO，必须使用 `glebarez/sqlite` 包装器。
-
-### 2.4 核心设计原则
-
-1. **Model 集中定义**：所有 GORM Model 在 `internal/store/model/` 包中
-2. **Repository 模式保留**：Repository struct 持有 `*gorm.DB`，对外方法签名尽量不变
-3. **Handler 不直接操作 DB**：所有数据库操作必须封装在 Repository 方法中
-4. **AutoMigrate 替代 schema.sql**：启动时自动迁移，不再维护手写 DDL
-5. **保留 PG 序列修复**：pgloader 迁移场景仍需 `ensurePostgresIDDefaults()`
-6. **Package 重命名**：`store/sqlite` → `store/repo`
-
---
-
-## 三、Model 设计
-
-### 3.1 GORM 类型映射
-
-| Go 类型 | GORM 行为 | PostgreSQL | SQLite |
-|---------|-----------|------------|--------|
-| `int64` + `primaryKey` | 自增主键 | `bigserial` | `INTEGER PRIMARY KEY AUTOINCREMENT` |
-| `int64` | 64位整数 | `bigint` | `integer` (SQLite 自动 64位) |
-| `int` | 整数 | `integer` | `integer` |
-| `float64` | 浮点 | `double precision` | `real` |
-| `string` + `size:100` | 变长字符 | `varchar(100)` | `varchar(100)` |
-| `string` (无 size) | 文本 | `text` | `text` |
-| `sql.NullInt64` | 可空整数 | `bigint NULL` | `integer NULL` |
-| `sql.NullString` | 可空文本 | `text NULL` | `text NULL` |
-
-### 3.2 表清单（21 张表）
-
-| 表名 | Model | 特殊处理 |
-|------|-------|----------|
-| `user` | `User` | `TableName()` 返回 `"user"` (PG 保留字) |
-| `forward` | `Forward` | |
-| `forward_port` | `ForwardPort` | |
-| `node` | `Node` | |
-| `speed_limit` | `SpeedLimit` | |
-| `statistics_flow` | `StatisticsFlow` | |
-| `tunnel` | `Tunnel` | |
-| `chain_tunnel` | `ChainTunnel` | |
-| `user_tunnel` | `UserTunnel` | 复合唯一索引 (user_id, tunnel_id) |
-| `tunnel_group` | `TunnelGroup` | |
-| `user_group` | `UserGroup` | |
-| `tunnel_group_tunnel` | `TunnelGroupTunnel` | 复合唯一索引 |
-| `user_group_user` | `UserGroupUser` | 复合唯一索引 |
-| `group_permission` | `GroupPermission` | 复合唯一索引 |
-| `group_permission_grant` | `GroupPermissionGrant` | 复合唯一索引 |
-| `vite_config` | `ViteConfig` | name 唯一 |
-| `peer_share` | `PeerShare` | token 唯一 |
-| `peer_share_runtime` | `PeerShareRuntime` | reservation_id, resource_key 唯一 |
-| `federation_tunnel_binding` | `FederationTunnelBinding` | 复合唯一索引 + resource_key 唯一 |
-| `announcement` | `Announcement` | |
-| `schema_version` | `SchemaVersion` | |
-
---
-
-## 四、详细实施步骤
-
-### 阶段 1：基础设施 — 添加依赖 + 定义 Model ✅ 已完成
-
-| 步骤 | 任务 | 文件 | 状态 |
-|------|------|------|------|
-| 1.1 | `go get gorm.io/gorm gorm.io/driver/postgres github.com/glebarez/sqlite` | `go.mod` | ✅ |
-| 1.2 | 创建 `internal/store/model/model.go`，定义全部 21 个表 Model | 新文件 | ✅ |
-| 1.3 | 为 `user` 表添加 `TableName()` 处理 PG 保留字 | model.go | ✅ |
-| 1.4 | 为复合唯一索引的表添加 GORM 索引 tag | model.go | ✅ |
-| 1.5 | 将 Backup 相关 struct 也迁移到 model/ | model.go | ✅ |
-| 1.6 | 验证 `go build ./...` 编译通过 | - | ✅ |
-
-### 阶段 2：GORM DB 初始化 ✅ 已完成
-
-| 步骤 | 任务 | 文件 | 状态 |
-|------|------|------|------|
-| 2.1 | 修改 Repository struct，`*store.DB` → `*gorm.DB` | repository.go | ✅ |
-| 2.2 | 重写 `Open()` — 用 `glebarez/sqlite` 打开 SQLite | repository.go | ✅ |
-| 2.3 | 重写 `OpenPostgres()` — 用 `gorm.io/driver/postgres` 打开 PG | repository.go | ✅ |
-| 2.4 | 用 `db.AutoMigrate()` 替代 `bootstrapSchema()` | repository.go | ✅ |
-| 2.5 | 实现种子数据逻辑（FirstOrCreate 替代 data.sql） | repository.go | ✅ |
-| 2.6 | 保留并适配 `ensurePostgresIDDefaults()`（用 `db.Exec()`） | repository.go | ✅ |
-| 2.7 | 保留并适配 `migrateSchema()` 增量迁移 | repository.go | ✅ |
-| 2.8 | `DB()` 方法返回 `*gorm.DB` | repository.go | ✅ |
-| 2.9 | SQLite 连接池设置 `MaxOpenConns(1)` 防锁 | repository.go | ✅ |
-
-### 阶段 3：重写 repository 查询方法 ⚠️ ~97% 完成
-
-将所有 raw SQL 查询替换为 GORM 链式调用。
-
-> **2026-02-16 审计**：基础 CRUD 查询已 GORM 化，但 mutation、JOIN 查询、import/export 仍大量使用 raw SQL。
-> **2026-02-17 更新**：已完成 `repository_mutations.go`、Import、以及 `repository_federation/control/flow` 查询层 GORM 化；`repository.go` 中 Raw 已清零，当前仅保留 4 处 PG 序列修复 DDL `Exec`。
-
-| 步骤 | 任务 | 方法数 | 状态 |
-|------|------|--------|------|
-| 3.1 | 用户查询：GetUserByUsername, GetUserByID, UsernameExists* 等 | ~5 | ✅ |
-| 3.2 | 配置查询：GetConfigByName, ListConfigs, UpsertConfig | ~3 | ✅ |
-| 3.3 | 公告查询：GetAnnouncement, UpsertAnnouncement | ~2 | ✅ |
-| 3.4 | 节点查询：GetNodeBy*, ListNodes, UpdateNode* | ~6 | ✅ |
-| 3.5 | 隧道查询：ListTunnels, ListTunnelGroups 等 (含 chain_tunnel 关联) | ~5 | ✅ |
-| 3.6 | 转发查询：ListForwards, resolveForwardIngress | ~3 | ✅ |
-| 3.7 | 用户隧道：GetUserPackageTunnels, GetUserPackageForwards | ~3 | ✅ |
-| 3.8 | 统计/限速：GetStatisticsFlows, ListSpeedLimits, AddFlow | ~4 | ✅ |
-| 3.9 | 分组查询：ListUserGroups, ListGroupPermissions 等 | ~4 | ✅ |
-| 3.10 | PeerShare 全部方法 (CRUD + Runtime) | ~15 | ✅ |
-| 3.11 | FederationTunnelBinding 全部方法 | ~4 | ✅ (Upsert 用 clause.OnConflict) |
-| 3.12 | Export 全部方法 | ~10 | ✅ |
-| 3.13 | Import 全部方法 | ~10 | ✅ 已全部改为 GORM `Clauses(clause.OnConflict)`（见 §9.6） |
-| **3.14** | **repository_mutations.go 全部方法 (~40 个)** | **~40** | **✅ 已全量改为 GORM 链式调用（见 §9.3）** |
-| **3.15** | **repository_federation.go 查询方法** | **~8** | **✅ 已全部改为 GORM 链式调用** |
-| **3.16** | **repository_control.go 复杂查询** | **~5** | **✅ 已全部改为 GORM 链式调用** |
-| **3.17** | **repository_flow.go 查询方法** | **~5** | **✅ 已全部改为 GORM 链式调用** |
-| **3.18** | **Jobs 查询方法 (repository.go 尾部)** | **~8** | **✅ 已 GORM 化** |
-
-### 阶段 4：消除 handler 中直接 SQL — 提取为 Repository 方法 ✅ 已完成
-
-> **2026-02-16 审计**：handler 中的 SQL 已大部分提取到 repo 层，但这些 repo 方法本身仍使用 raw SQL（见阶段 3）。
-> **2026-02-17 更新**：`mutations.go` 直接 `tx.Exec`/`tx.Raw` 已从 27 处降至 0 处（生产代码），详见 §9.4。
-
-mutations.go 和其他 handler 文件中大量直接操作 `h.repo.DB()` 执行 raw SQL，需要：
-1. 将 SQL 逻辑提取为 Repository 方法
-2. Handler 只调用 Repository 方法
-
-| 步骤 | 任务 | 文件 | 状态 |
-|------|------|------|------|
-| 4.1 | 用户 CRUD：userCreate, userUpdate, userDelete, userResetFlow | mutations.go | ✅ 已提取到 repo 方法 |
-| 4.2 | 节点 CRUD：nodeCreate, nodeUpdate, nodeDelete, nodeBatch* | mutations.go | ✅ 已提取到 repo 方法 |
-| 4.3 | 隧道 CRUD：tunnelCreate, tunnelUpdate, tunnelDelete, tunnelBatch* | mutations.go | ✅ tunnelCreate/Update 的 SQL 已下沉 repo |
-| 4.4 | 转发 CRUD：forwardCreate, forwardUpdate, forwardDelete, forwardBatch* | mutations.go | ✅ 已提取到 repo (CreateForwardTx 等) |
-| 4.5 | 限速 CRUD：speedLimitCreate, speedLimitUpdate, speedLimitDelete | mutations.go | ✅ 已提取到 repo 方法 |
-| 4.6 | 分组 CRUD：所有 group* 方法 | mutations.go | ✅ 成员同步/权限管理 SQL 已下沉 repo |
-| 4.7 | 用户隧道：userTunnelAssign, userTunnelRemove, userTunnelUpdate | mutations.go | ✅ 已提取到 repo 方法 |
-| 4.8 | handler.go 中的直接 SQL (openAPISubStore 等) | handler.go | ✅ 已迁移（含 nil 检查清理） |
-| 4.9 | federation.go 中的 raw SQL | federation.go | ✅ 已提取到 repo_federation.go |
-| 4.10 | control_plane.go 中的 raw SQL | control_plane.go | ✅ 已提取到 repo_control.go |
-| 4.11 | flow_policy.go 中的 raw SQL | flow_policy.go | ✅ 已提取到 repo_flow.go |
-| 4.12 | jobs.go 中的 raw SQL | jobs.go | ✅ 已提取到 repo 方法（含 nil 检查清理） |
-
-### 阶段 5：清理旧代码 ✅ 已完成
-
-| 步骤 | 任务 | 文件 | 状态 |
-|------|------|------|------|
-| 5.1 | 删除 `internal/store/postgres/` 整个目录 | 目录删除 | ✅ |
-| 5.2 | 删除 `internal/store/sqlite/sql/` 目录 | 目录删除 | ✅ |
-| 5.3 | 删除 `internal/store/db.go` SQL 重写层 | 文件删除 | ✅ |
-| 5.4 | 删除 `internal/store/db_test.go` | 文件删除 | ✅ |
-| 5.5 | 清理 repository.go 中不再需要的 embed 指令 | 清理 | ✅ |
-
-### 阶段 6：Package 重命名 ✅ 已完成
-
-| 步骤 | 任务 | 文件 | 状态 |
-|------|------|------|------|
-| 6.1 | `internal/store/sqlite/` → `internal/store/repo/` | 目录重命名 | ✅ |
-| 6.2 | 更新所有 import 路径：`store/sqlite` → `store/repo` (13处) | 全局替换 | ✅ |
-
-### 阶段 7：测试 + 验证 ⚠️ 部分完成
-
-| 步骤 | 任务 | 状态 |
-|------|------|------|
-| 7.1 | 更新所有现有测试适配 GORM | ✅ 测试已适配 (使用 repo.DB() 做数据准备) |
-| 7.2 | `go test ./...` 全部通过 | ✅ 已通过（含 `internal/http/handler`、`tests/contract`） |
-| 7.3 | `make build` 构建成功 | ✅ 已通过 |
-
-### 阶段 8：文档更新 ✅ 已完成
-
-| 步骤 | 任务 | 文件 | 状态 |
-|------|------|------|------|
-| 8.1 | 更新 `go-backend/AGENTS.md` — 移除 "DO NOT USE ORM"，记录 GORM 规范 | AGENTS.md | ✅ |
-| 8.2 | 更新根 `AGENTS.md` | AGENTS.md | ✅ |
-| 8.3 | 更新 `handler/AGENTS.md` | AGENTS.md | ✅ |
-
---
-
-## 五、GORM 使用规范
-
-### 5.1 查询模式
-
-```go
-// 单条查询 - 未找到返回 nil, nil (保持现有语义)
-var user model.User
-err := r.db.Where("id = ?", id).First(&user).Error
-if errors.Is(err, gorm.ErrRecordNotFound) {
-    return nil, nil
-}
-
-// 列表查询
-var users []model.User
-err := r.db.Where("role_id != ?", 0).Order("id ASC").Find(&users).Error
-
-// 创建
-err := r.db.Create(&user).Error
-
-// 更新 (部分字段)
-err := r.db.Model(&model.User{}).Where("id = ?", id).Updates(map[string]interface{}{
-    "user": username, "flow": flow, "updated_time": now,
-}).Error
-
-// 事务 (closure pattern - 自动 rollback/commit)
-err := r.db.Transaction(func(tx *gorm.DB) error {
-    if err := tx.Where("user_id = ?", id).Delete(&model.Forward{}).Error; err != nil {
-        return err
-    }
-    return tx.Where("id = ?", id).Delete(&model.User{}).Error
-})
-
-// 原生 SQL (仅用于复杂查询和 PG 特有操作)
-r.db.Exec("SELECT setval(?::regclass, ?, ?)", seqRef, maxID, true)
-```
-
-### 5.2 关键注意事项
-
-1. **user 保留字**：通过 `TableName()` 返回 `"user"`，GORM 自动处理引号
-2. **SQLite MaxOpenConns**：必须设为 1 防止 "database locked"
-3. **SQLite WAL 模式**：DSN 中配置 `_pragma=journal_mode(WAL)`
-4. **不要用 `type:jsonb`**：SQLite 不支持，用 `serializer:json`
-5. **不要用 `type:serial`**：让 GORM 从 `primaryKey` 自动推断
-6. **AutoMigrate 在 SQLite 中使用 copy-swap-drop**：大表慎用
-
---
-
-## 六、影响范围
-
-### 需要修改的文件
-
-| 文件 | 修改类型 | 描述 | 当前状态 |
-|------|----------|------|----------|
-| `go.mod` / `go.sum` | 修改 | 添加 GORM + 驱动依赖 | ✅ |
-| `internal/store/model/model.go` | **新增** | 全部 21 个 GORM Model | ✅ |
-| `internal/store/repo/repository.go` | **重写** | 全部查询 GORM 化 | ⚠️ 业务查询已 GORM；仅剩 PG 序列修复 DDL `Exec` 4 处 |
-| `internal/store/repo/repository_mutations.go` | **重写** | Mutation helpers | ✅ 全量 GORM（Raw=0） |
-| `internal/store/repo/repository_federation.go` | **重写** | Federation 查询 | ✅ 已 GORM 化（Raw=0） |
-| `internal/store/repo/repository_control.go` | **重写** | 控制面查询 | ✅ 已 GORM 化（Raw=0） |
-| `internal/store/repo/repository_flow.go` | **重写** | 流量/转发查询 | ✅ 已 GORM 化（Raw=0） |
-| `internal/http/handler/mutations.go` | **重写** | 全部 CRUD 提取到 repo | ✅ 生产代码 `tx.Exec/tx.Raw` = 0 |
-| `internal/http/handler/handler.go` | 修改 | 更新 import、移除直接 SQL | ✅ (仅剩 nil check) |
-| `internal/http/handler/federation.go` | 修改 | GORM 替代 raw SQL | ✅ |
-| `internal/http/handler/control_plane.go` | 修改 | GORM 替代 raw SQL | ✅ |
-| `internal/http/handler/flow_policy.go` | 修改 | GORM 替代 raw SQL | ✅ |
-| `internal/http/handler/jobs.go` | 修改 | GORM 替代 raw SQL | ✅ (仅剩 nil check) |
-| `internal/ws/server.go` | 修改 | 更新 import | ✅ |
-| `internal/app/app.go` | 修改 | 更新 import | ✅ |
-| `internal/store/postgres/` | **删除** | 不再需要 | ✅ |
-| `internal/store/db.go` | **删除** | GORM 自动处理方言 | ✅ |
-| `internal/store/db_test.go` | **删除** | 旧重写层测试 | ✅ |
-| `internal/store/sqlite/sql/` | **删除** | AutoMigrate 替代 | ✅ |
-| `tests/contract/*.go` | 修改 | 适配 GORM | ✅ |
-| `AGENTS.md` (3处) | 更新 | 反映新架构 | ✅ |
-
-### 不需要修改的文件
-
- `internal/http/router.go` — 路由不变
- `internal/config/config.go` — 配置不变
- `internal/auth/` — 认证不变
- `internal/security/` — 加密不变
- `internal/http/middleware/` — 中间件不变
- `internal/http/response/` — 响应格式不变
- `Dockerfile`, `Makefile` — 构建不变
-
---
-
-## 七、风险与缓解
-
-| 风险 | 可能性 | 影响 | 缓解措施 |
-|------|--------|------|----------|
-| GORM AutoMigrate SQLite/PG 行为差异 | 中 | 高 | 先写 Model 验证双数据库 AutoMigrate |
-| handler 中散落 raw SQL 遗漏 | 中 | 高 | 全局搜索 `.Exec(`, `.Query(`, `.QueryRow(` |
-| 事务语义变化 | 低 | 中 | 逐方法对比旧代码事务边界 |
-| 大量代码变更导致回归 | 高 | 高 | 分阶段提交，每阶段 `go test` |
-| GORM 性能开销 | 低 | 低 | 此场景下可忽略 |
-| SQLite "database locked" | 中 | 高 | `MaxOpenConns(1)` + WAL 模式 |
-
---
-
-## 八、迁移顺序原则
-
-1. **先 Model 后查询**：确保 AutoMigrate 双数据库通过
-2. **先 Repository 后 Handler**：Handler 依赖 Repository
-3. **先核心后边缘**：User → Node → Tunnel → Forward → 分组 → Federation
-4. **每步编译**：每完成一组方法确保 `go build ./...` 通过
-5. **最后清理**：全部重写完成后再删除旧代码和重命名 package
-
---
-
---
-
-## 九、2026-02-16 审计发现 + 2026-02-17 进展记录
-
-### 9.1 总体完成度
-
-| 指标 | 数值 |
-|------|------|
-| 阶段完成数 | 7/8 完成 (1, 2, 4, 5, 6, 7, 8)，1/8 部分完成 (3) |
-| GORM 链式调用 | ~226 处 |
-| Raw SQL 调用 (`.Exec`/`.Raw`+`.Scan`) | 4 处（生产代码） |
-| GORM 占比 | ~98% |
-| Handler 内 `tx.Exec`/`tx.Raw` | 0 处（生产代码） |
-| `last_insert_rowid()` 生产代码 | 0 处（已消灭） |
-
-### 9.2 ✅ P0：`last_insert_rowid()`（生产代码）已清零
-
-`last_insert_rowid()` 已从生产路径移除，创建主键统一改为 `Create(&model)` 自动回填 ID，
-确保 SQLite / PostgreSQL 双数据库行为一致。
-
-> 备注：测试代码中的历史 SQL 兼容性用例可在后续测试清理阶段单独处理。
-
-### 9.3 ✅ P1：`repository_mutations.go` 已全量 GORM 化
-
-本次已完成 `repository_mutations.go` 的集中清理：
-
-1. User / Node / Tunnel / Forward / UserTunnel / SpeedLimit / Group / Permission 全部 mutation 方法改为 GORM 链式调用。
-2. 事务内级联删除统一为 `tx.Where(...).Delete(&Model{})` 模式。
-3. `ON CONFLICT DO NOTHING` 统一替换为 `Clauses(clause.OnConflict{DoNothing: true})`。
-4. 保留原有调用语义（含 `sql.ErrNoRows` 行为兼容）并完成 `go build ./...` 验证。
-
-> 当前 `repository_mutations.go` 中生产代码 `.Raw(`/`.Exec(` 调用已降为 0。
-
-### 9.4 ✅ P2：Handler `mutations.go` 直接 SQL 已清零
-
-2026-02-17 本轮静态扫描结果：`mutations.go` **0 处** `tx.Exec`/`tx.Raw`（生产代码）。
-
-本轮完成下沉到 repo 的逻辑：
-
- `tunnelUpdate` 中 `UPDATE tunnel` + `DELETE chain_tunnel`
- `isRemoteNodeTx` 查询
- `pickNodePortTx` 的 node/chain_tunnel/forward_port 端口占用查询
- `replaceTunnelChainsTx` 的 chain_tunnel 写入
- 分组成员同步（`tunnel_group_tunnel` / `user_group_user`）
- 权限删除与 grant 回收（`group_permission` / `group_permission_grant` / `user_tunnel`）
- federation 绑定替换（`federation_tunnel_binding`）
-
-### 9.5 ✅ P3（部分）：已移除 `QueryInt64List` / `QueryPairs` SQL 透传
-
- `repository_mutations.go` 中两个 SQL 透传入口已删除。
- Handler 已切换为语义化 repo 方法：
-  - `ListUserIDsByUserGroup`
-  - `ListTunnelIDsByTunnelGroup`
-  - `ListGroupPermissionPairsByUserGroup`
-  - `ListGroupPermissionPairsByTunnelGroup`
-
-### 9.6 ✅ P3：Import 函数已全部 GORM 化
-
-`repository.go` 中 Import 相关函数已完成迁移：
-
- `importUsers`
- `importNodes`
- `importTunnels`（含 `chain_tunnel` 子项 upsert）
- `importForwards`（含 `forward_port` 覆盖写入）
- `importUserTunnels`
- `importSpeedLimits`
- `importTunnelGroups`
- `importUserGroups`
- `importPermissions`
- `importConfigs`（原本已是 GORM）
-
-迁移后统一采用 `Clauses(clause.OnConflict{Columns: id/name, DoUpdates: ...}).Create(&model)` 模式，
-保留原 `ON CONFLICT ... DO UPDATE` 语义；Import 区段 `tx.Exec`/`tx.Raw` 已清零。
-
-### 9.7 ✅ P4：`h.repo.DB() == nil` 检查已清理
-
-`internal/http/handler/` 下已无 `h.repo.DB()` 直接访问；handler 仅通过语义化 repo 方法进行数据访问。
-
-### 9.8 ✅ P5：Repository 层 Raw 已收敛（仅保留 PG 序列修复 DDL）
-
-当前生产代码中 `.Raw()` 已清零；仅剩 `repository.go` 的 4 处 `Exec()`，全部位于 PG 序列修复 DDL：
-
- `CREATE SEQUENCE IF NOT EXISTS ...`
- `ALTER TABLE ... ALTER COLUMN id SET DEFAULT nextval(...)`
- `ALTER SEQUENCE ... OWNED BY ...`
- `SELECT setval(...::regclass, ?, ?)`
-
-以上 4 处属于数据库管理 DDL/序列同步语义，当前保留，不再继续向 GORM 链式调用替换。
-
-`repository_federation.go` / `repository_control.go` / `repository_flow.go` 已完成 GORM 化（Raw=0）。
-
---
-
-## 十、后续工作优先级
-
-| 优先级 | 任务 | 影响范围 | 工作量 |
-|--------|------|----------|--------|
-| **P0** | ✅ 已完成：生产代码中 `last_insert_rowid()` 清零（测试用例待单独清理） | 6 处生产（已完成） | 完成 |
-| **P1** | ✅ 已完成：`repository_mutations.go` ~40 方法改为 GORM 链式调用 | 659 行（已完成） | 完成 |
-| **P2** | ✅ 已完成：`mutations.go` handler 直接 SQL 全部提取为 repo 方法 | mutations.go | 完成 |
-| **P3** | ✅ 已完成：移除 `QueryInt64List`/`QueryPairs` 透传，切换语义化 repo 方法 | 2 个方法 + 调用方（已完成） | 完成 |
-| **P3** | ✅ 已完成：Import 函数 Raw SQL 改为 GORM `Clauses(clause.OnConflict{}).Create()` | 9 个函数（已完成） | 完成 |
-| **P4** | ✅ 已完成：`h.repo.DB() == nil` 检查清理完毕 | 4 处（已完成） | 完成 |
-| **P5** | ✅ 已完成：repo 查询层 Raw 清零，`repository.go` 保留 4 处 PG 序列修复 DDL `Exec`（设计保留） | repository.go | 完成 |
-| **P5** | ✅ 已完成：更新 MIGRATION_PLAN.md 状态标记与收尾记录 | 本文件 | 完成 |
-
-### 10.5 本轮执行记录（2026-02-17，P5 schema 收尾）
-
-1. 完成 `repository.go` schema 迁移段去 Raw：
-   - `normalizeStrategy` 改为 `Model(...).Where(...).Update(...)`
-   - `ensurePostgresIDDefaults`/`ensurePostgresTableIDDefault` 的 information_schema 查询改为 GORM `Table+Joins+Where+Scan`
-   - `syncPostgresTableIDSequence` 的 `MAX(id)` 查询改为 GORM `Table+Select+Scan`
-2. 复扫结果：
-   - `repository.go` `.Raw()` = 0
-   - repo 生产路径剩余 `.Exec()` = 4（全部为 PG 序列修复 DDL）
-3. 验证结果：
-   - `go build ./...` ✅
-   - `go test ./internal/store/repo/...` ✅
-
-### 10.6 本轮执行记录（2026-02-17，测试/构建收尾）
-
-1. 修复事务内 SQLite 连接阻塞（`MaxOpenConns(1)` 场景）：
-   - 新增 `GetNodeRecordTx` 并在 `prepareTunnelCreateState` 使用事务句柄读取节点。
-   - 新增 `GetNodeRemoteFieldsTx` 并在 `tunnelCreate` 事务内改用事务句柄读取远端字段。
-   - `applyFederationRuntime` 改为显式接收 `localDomain`，避免事务内再次走 `repo.GetConfigByName`。
-2. 修复 legacy SQLite schema 迁移契约：
-   - 新增 `prepareSQLiteLegacyColumns` 预补齐 `node/tunnel` 关键列。
-   - SQLite 模式下对已存在 `node/tunnel` 表跳过对应 `AutoMigrate` 重建流程，避免 `node__temp.name` 约束失败。
-3. 验证结果：
-   - `go test ./internal/http/handler/...` ✅
-   - `go test ./tests/contract/...` ✅
-   - `go test ./...` ✅
-   - `go build ./...` ✅
-   - `make build` ✅
-
-### 10.1 本轮执行记录（2026-02-17，P5 查询层）
-
-1. 完成 `repository_federation.go` 全量 GORM 化：
-   - `ListRemoteNodes` / `UpdateNodeRemoteConfig`
-   - `ListActiveBindingsForNode` / `GetNodeBasicInfo`
-   - `ListUsedPortsOnNode` / `ListTunnelIDsByNamePrefix` / `NextIndex`
-2. 完成 `repository_control.go` 全量 GORM 化：
-   - `ListForwardsByTunnel` / `ListForwardPorts` / `GetTunnelOutProtocol`
-   - `ResolveUserTunnelAndLimiter` / `ListChainNodesForTunnel`
-3. 完成 `repository_flow.go` 全量 GORM 化：
-   - `ListActiveForwardsByUser` / `ListActiveForwardsByUserTunnel`
-   - `GetForwardRecord` / `GetTunnelRecord`
-4. 复扫结果：
-   - `repository_federation.go` Raw/Exec = 0
-   - `repository_control.go` Raw/Exec = 0
-   - `repository_flow.go` Raw/Exec = 0
-   - repo 生产路径剩余 Raw/Exec = 9（全部在 `repository.go`）
-5. 验证结果：
-   - `go build ./...` ✅
-   - `go test ./internal/store/repo/...` ✅
-
-### 10.2 本轮执行记录（2026-02-17）
-
-1. 完成 P3 Import 9 个函数的 GORM 化（`repository.go`），并保持 `ON CONFLICT` 语义一致。
-2. 复扫确认：`repository.go` Import 区段 `tx.Exec`/`tx.Raw` 已清零。
-3. 验证结果：
-   - `go build ./...` ✅（使用显式 `GOMODCACHE/GOPATH/GOCACHE/HOME` 环境）
-   - `go test ./internal/store/repo/...` ✅
-
-### 10.3 本轮执行记录（2026-02-17，P2 部分）
-
-1. 将 tunnel 更新/chain 重建路径 SQL 下沉到 `repository_mutations.go`：
-   - 新增 `UpdateTunnelTx`
-   - 新增 `DeleteChainTunnelsByTunnelTx`
-   - 新增 `CreateChainTunnelTx`
-2. 将 handler 内部 SQL helper 迁移到 repo：
-   - 新增 `IsRemoteNodeTx`
-   - 新增 `PickNodePortTx`
-   - `replaceTunnelChainsTx` 改为 handler 方法并改用 repo 调用，不再直接 SQL
-3. 复扫结果：`mutations.go` 直接 SQL 从 27 处降至 17 处。
-4. 验证结果：
-   - `go build ./...` ✅
-   - `go test ./internal/store/repo/...` ✅
-
-### 10.4 本轮执行记录（2026-02-17，P2 收尾）
-
-1. 新增并落地事务语义化 repo 方法：
-   - `ReplaceTunnelGroupMembersTx` / `ReplaceUserGroupMembersTx`
-   - `ListUserIDsByUserGroupTx`
-   - `GetGroupPermissionPairByIDTx` / `DeleteGroupPermissionByIDTx`
-   - `RevokeGroupGrantsForRemovedUsersTx` / `RevokeGroupPermissionPairTx`
-   - `ReplaceFederationTunnelBindingsTx`
-2. 删除 handler 内 SQL helper（`queryInt64ListTx` / `revokeGroupGrantsForRemovedUsersTx` / `revokeGroupPermissionPairTx` / `replaceFederationTunnelBindingsTx`）。
-3. 复扫确认：`mutations.go` 生产路径 `tx.Exec`/`tx.Raw` = 0。
-4. 验证结果：
-   - `go build ./...` ✅
-   - `go test ./internal/store/repo/...` ✅
-
---
-
-*本文档将随迁移进展实时更新状态标记。*
-*最后审计时间：2026-02-17，审计工具：代码静态分析 (grep/AST) + go build/go test 验证*
@@ -12,14 +12,10 @@ require (

 require (
 	github.com/dustin/go-humanize v1.0.1 // indirect
-	github.com/glebarez/go-sqlite v1.21.2 // indirect
-	github.com/glebarez/sqlite v1.11.0 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
 	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
 	github.com/jackc/puddle/v2 v2.2.2 // indirect
-	github.com/jinzhu/inflection v1.0.0 // indirect
-	github.com/jinzhu/now v1.1.5 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/ncruces/go-strftime v0.1.9 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
@@ -28,8 +24,6 @@ require (
 	golang.org/x/sync v0.17.0 // indirect
 	golang.org/x/sys v0.33.0 // indirect
 	golang.org/x/text v0.29.0 // indirect
-	gorm.io/driver/postgres v1.6.0 // indirect
-	gorm.io/gorm v1.31.1 // indirect
 	modernc.org/libc v1.65.7 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
 	modernc.org/memory v1.11.0 // indirect
@@ -3,10 +3,6 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
-github.com/glebarez/go-sqlite v1.21.2 h1:3a6LFC4sKahUunAmynQKLZceZCOzUthkRkEAl9gAXWo=
-github.com/glebarez/go-sqlite v1.21.2/go.mod h1:sfxdZyhQjTM2Wry3gVYWaW072Ri1WMdWJi0k6+3382k=
-github.com/glebarez/sqlite v1.11.0 h1:wSG0irqzP6VurnMEpFGer5Li19RpIRi2qvQz++w0GMw=
-github.com/glebarez/sqlite v1.11.0/go.mod h1:h8/o8j5wiAsqSPoWELDUdJXhjAhsVliSn7bWZjOhrgQ=
 github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e h1:ijClszYn+mADRFY17kjQEVQ1XRhq2/JR1M3sGqeJoxs=
 github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
@@ -21,10 +17,6 @@ github.com/jackc/pgx/v5 v5.7.3 h1:PO1wNKj/bTAwxSJnO1Z4Ai8j4magtqg2SLNjEDzcXQo=
 github.com/jackc/pgx/v5 v5.7.3/go.mod h1:ncY89UGWxg82EykZUwSpUKEfccBGGYq1xjrOpsbsfGQ=
 github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
 github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
-github.com/jinzhu/inflection v1.0.0 h1:K317FqzuhWc8YvSVlFMCCUb36O/S9MCKRDI7QkRKD/E=
-github.com/jinzhu/inflection v1.0.0/go.mod h1:h+uFLlag+Qp1Va5pdKtLDYj+kHp5pxUVkryuEj+Srlc=
-github.com/jinzhu/now v1.1.5 h1:/o9tlHleP7gOFmsnYNz3RGnqzefHA47wQpKrrdTIwXQ=
-github.com/jinzhu/now v1.1.5/go.mod h1:d3SSVoowX0Lcu0IBviAWJpolVfI5UJVZZ7cO71lE/z8=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/ncruces/go-strftime v0.1.9 h1:bY0MQC28UADQmHmaF5dgpLmImcShSi2kHU9XLdhx/f4=
@@ -57,10 +49,6 @@ gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gorm.io/driver/postgres v1.6.0 h1:2dxzU8xJ+ivvqTRph34QX+WrRaJlmfyPqXmoGVjMBa4=
-gorm.io/driver/postgres v1.6.0/go.mod h1:vUw0mrGgrTK+uPHEhAdV4sfFELrByKVGnaVRkXDhtWo=
-gorm.io/gorm v1.31.1 h1:7CA8FTFz/gRfgqgpeKIBcervUn3xSyPUmr6B2WXJ7kg=
-gorm.io/gorm v1.31.1/go.mod h1:XyQVbO2k6YkOis7C2437jSit3SsDK72s7n7rsSHd+Gs=
 modernc.org/cc/v4 v4.26.1 h1:+X5NtzVBn0KgsBCBe+xkDC7twLb/jNVj9FPgiwSQO3s=
 modernc.org/cc/v4 v4.26.1/go.mod h1:uVtb5OGqUKpoLWhqwNQo/8LwvoiEBLvZXIQ/SmO6mL0=
 modernc.org/ccgo/v4 v4.28.0 h1:rjznn6WWehKq7dG4JtLRKxb52Ecv8OUGah8+Z/SfpNU=
@@ -10,30 +10,30 @@ import (
 	"go-backend/internal/config"
 	httpserver "go-backend/internal/http"
 	"go-backend/internal/http/handler"
-	"go-backend/internal/store/repo"
+	"go-backend/internal/store/sqlite"
 )

 type App struct {
 	cfg    config.Config
 	server *http.Server
-	repo   *repo.Repository
+	repo   *sqlite.Repository
 	h      *handler.Handler
 }

 func New(cfg config.Config) (*App, error) {
 	var (
-		r   *repo.Repository
-		err error
+		repo *sqlite.Repository
+		err  error
 	)

 	switch strings.ToLower(strings.TrimSpace(cfg.DBType)) {
 	case "", "sqlite":
-		r, err = repo.Open(cfg.DBPath)
+		repo, err = sqlite.Open(cfg.DBPath)
 		if err != nil {
 			return nil, fmt.Errorf("open sqlite: %w", err)
 		}
 	case "postgres", "postgresql":
-		r, err = repo.OpenPostgres(cfg.DatabaseURL)
+		repo, err = sqlite.OpenPostgres(cfg.DatabaseURL)
 		if err != nil {
 			return nil, fmt.Errorf("open postgres: %w", err)
 		}
@@ -41,7 +41,7 @@ func New(cfg config.Config) (*App, error) {
 		return nil, fmt.Errorf("unsupported DB_TYPE %q", cfg.DBType)
 	}

-	h := handler.New(r, cfg.JWTSecret)
+	h := handler.New(repo, cfg.JWTSecret)
 	router := httpserver.NewRouter(h, cfg.JWTSecret)

 	s := &http.Server{
@@ -49,11 +49,11 @@ func New(cfg config.Config) (*App, error) {
 		Handler:           router,
 		ReadTimeout:       30 * time.Second,
 		ReadHeaderTimeout: 5 * time.Second,
-		WriteTimeout:      2 * time.Minute,
+		WriteTimeout:      30 * time.Second,
 		IdleTimeout:       60 * time.Second,
 	}

-	return &App{cfg: cfg, server: s, repo: r, h: h}, nil
+	return &App{cfg: cfg, server: s, repo: repo, h: h}, nil
 }

 func (a *App) Run() error {
@@ -1,10 +1,10 @@
 # BACKEND HTTP HANDLER KNOWLEDGE BASE

-**Generated:** Thu Feb 26 2026
+**Generated:** Sun Feb 15 2026

 ## OVERVIEW
 HTTP request handlers for FLVX Admin API. Core business logic layer.
-**Stack:** Go 1.24, net/http, GORM via Repository pattern.
+**Stack:** Go 1.23, net/http, raw SQL (no ORM).

 ## STRUCTURE
 ```
@@ -14,7 +14,7 @@ handler/
 ├── federation.go     # Federation/cluster sync API
 ├── flow_policy.go    # Traffic policy API
 ├── jobs.go           # Background job management (sync, cleanup)
-├── mutations.go      # CRUD for users, tunnels, forwards (~3700 LOC)
+├── mutations.go      # CRUD for users, tunnels, forwards (largest: 100k+ LOC)
 └── upgrade.go        # System upgrade API
 ```

@@ -26,17 +26,15 @@ handler/
 | **Federation Sync** | `federation.go` | Panel-to-panel sync |
 | **Traffic Policies** | `flow_policy.go` | Flow limiting, quota management |
 | **Background Jobs** | `jobs.go` | Scheduled sync/cleanup tasks |
-| **Node Control** | `control_plane.go` | Node add/delete/list operations |

 ## CONVENTIONS
- Inherits from parent: GORM via Repository pattern, JWT in Authorization header.
- Large files expected (`mutations.go` ~3700 LOC - central mutation hub).
- Uses `repo.Repository` for DB access via `h.repo.XXX()` methods.
- Handlers never call `repo.DB()` directly — all queries go through Repository methods.
+- Inherits from parent: raw SQL, no ORM, JWT in Authorization header.
+- Large files expected (`mutations.go` 3716 LOC - central mutation hub).
+- Uses `sqlite.Repository` for DB access via `repo.XXX()` methods.
 - Domain-driven file split: one file per functional area (federation, jobs, etc.).

 ## ANTI-PATTERNS
- Do NOT let handlers call `repo.DB()` directly — add a Repository method instead.
+- Do NOT add ORM here - uses raw SQL throughout.
 - Do NOT change handler signatures without updating router.go.

 ## COMMANDS
@@ -53,61 +53,3 @@ func TestShouldTryLegacySingleService(t *testing.T) {
 		t.Fatalf("DeleteService should not require legacy fallback")
 	}
 }
-
-func TestIsAlreadyExistsMessage(t *testing.T) {
-	if !isAlreadyExistsMessage("service demo already exists") {
-		t.Fatalf("expected already exists message to be tolerated")
-	}
-	if !isAlreadyExistsMessage("服务已存在") {
-		t.Fatalf("expected Chinese already exists message to be tolerated")
-	}
-	if isAlreadyExistsMessage("listen tcp [::]:10001: bind: address already in use") {
-		t.Fatalf("address already in use must not be treated as already exists")
-	}
-}
-
-func TestBuildForwardServiceConfigs_UsesBindIPForListen(t *testing.T) {
-	forward := &forwardRecord{RemoteAddr: "1.2.3.4:80", Strategy: "fifo", TunnelID: 7}
-	node := &nodeRecord{TCPListenAddr: "[::]", UDPListenAddr: "[::]"}
-	services := buildForwardServiceConfigs("1_2_0", forward, nil, node, 22000, "10.9.8.7", nil, false)
-	if len(services) != 2 {
-		t.Fatalf("expected 2 services, got %d", len(services))
-	}
-	for _, svc := range services {
-		addr, _ := svc["addr"].(string)
-		if addr != "10.9.8.7:22000" {
-			t.Fatalf("expected bind IP address 10.9.8.7:22000, got %q", addr)
-		}
-	}
-}
-
-func TestBuildForwardServiceConfigs_DefaultListenAddrWhenBindIPEmpty(t *testing.T) {
-	forward := &forwardRecord{RemoteAddr: "1.2.3.4:80", Strategy: "fifo", TunnelID: 7}
-	node := &nodeRecord{TCPListenAddr: "0.0.0.0", UDPListenAddr: "[::]"}
-	services := buildForwardServiceConfigs("1_2_0", forward, nil, node, 22001, "", nil, false)
-	if len(services) != 2 {
-		t.Fatalf("expected 2 services, got %d", len(services))
-	}
-	tcpAddr, _ := services[0]["addr"].(string)
-	udpAddr, _ := services[1]["addr"].(string)
-	if tcpAddr != "0.0.0.0:22001" {
-		t.Fatalf("expected tcp addr 0.0.0.0:22001, got %q", tcpAddr)
-	}
-	if udpAddr != "[::]:22001" {
-		t.Fatalf("expected udp addr [::]:22001, got %q", udpAddr)
-	}
-}
-func TestBuildForwardServiceConfigs_BindIPAlreadyContainsPort(t *testing.T) {
-	forward := &forwardRecord{RemoteAddr: "1.2.3.4:80", Strategy: "fifo", TunnelID: 7}
-	node := &nodeRecord{TCPListenAddr: "[::]", UDPListenAddr: "[::]"}
-	services := buildForwardServiceConfigs("1_2_0", forward, nil, node, 55555, "3.3.3.3:12345", nil, false)
-	if len(services) != 2 {
-		t.Fatalf("expected 2 services, got %d", len(services))
-	}
-	for _, svc := range services {
-		addr, _ := svc["addr"].(string)
-		if addr != "3.3.3.3:12345" {
-			t.Fatalf("expected bind IP with port 3.3.3.3:12345, got %q", addr)
-		}
-	}
-}
@@ -1,50 +0,0 @@
-package handler
-
-import (
-	"testing"
-
-	"go-backend/internal/store/repo"
-)
-
-func mustLastInsertID(t *testing.T, r *repo.Repository, label string) int64 {
-	t.Helper()
-	var id int64
-	if err := r.DB().Raw("SELECT last_insert_rowid()").Row().Scan(&id); err != nil {
-		t.Fatalf("read last_insert_rowid for %s: %v", label, err)
-	}
-	if id <= 0 {
-		t.Fatalf("invalid last_insert_rowid for %s: %d", label, id)
-	}
-	return id
-}
-
-func mustQueryInt(t *testing.T, r *repo.Repository, query string, args ...interface{}) int {
-	t.Helper()
-	var v int
-	if err := r.DB().Raw(query, args...).Row().Scan(&v); err != nil {
-		t.Fatalf("query int failed: %v (query=%q)", err, query)
-	}
-	return v
-}
-
-func mustQueryInt64Int64String(t *testing.T, r *repo.Repository, query string, args ...interface{}) (int64, int64, string) {
-	t.Helper()
-	var a int64
-	var b int64
-	var c string
-	if err := r.DB().Raw(query, args...).Row().Scan(&a, &b, &c); err != nil {
-		t.Fatalf("query int64+int64+string failed: %v (query=%q)", err, query)
-	}
-	return a, b, c
-}
-
-func mustQueryInt64Int64Int(t *testing.T, r *repo.Repository, query string, args ...interface{}) (int64, int64, int) {
-	t.Helper()
-	var a int64
-	var b int64
-	var c int
-	if err := r.DB().Raw(query, args...).Row().Scan(&a, &b, &c); err != nil {
-		t.Fatalf("query int64+int64+int failed: %v (query=%q)", err, query)
-	}
-	return a, b, c
-}
@@ -1,209 +0,0 @@
-package handler
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"net/http"
-	"strings"
-	"time"
-
-	"go-backend/internal/http/response"
-)
-
-type diagnosisStreamEvent struct {
-	Type string      `json:"type"`
-	Data interface{} `json:"data,omitempty"`
-	TS   int64       `json:"ts"`
-}
-
-func prepareDiagnosisStreamResponse(w http.ResponseWriter) (http.Flusher, error) {
-	flusher, ok := w.(http.Flusher)
-	if !ok {
-		return nil, errors.New("当前服务不支持流式响应")
-	}
-	w.Header().Set("Content-Type", "application/x-ndjson; charset=utf-8")
-	w.Header().Set("Cache-Control", "no-cache")
-	w.Header().Set("Connection", "keep-alive")
-	w.Header().Set("X-Accel-Buffering", "no")
-	return flusher, nil
-}
-
-func writeDiagnosisStreamEvent(encoder *json.Encoder, flusher http.Flusher, eventType string, data interface{}) error {
-	if encoder == nil || flusher == nil {
-		return errors.New("流式响应写入器未初始化")
-	}
-	event := diagnosisStreamEvent{Type: eventType, Data: data, TS: time.Now().UnixMilli()}
-	if err := encoder.Encode(event); err != nil {
-		return err
-	}
-	flusher.Flush()
-	return nil
-}
-
-func summarizeDiagnosisProgress(results []map[string]interface{}) diagnosisProgress {
-	progress := diagnosisProgress{Total: len(results)}
-	for _, item := range results {
-		progress.Completed++
-		if asBool(item["success"], false) {
-			progress.Success++
-		} else {
-			progress.Failed++
-		}
-	}
-	return progress
-}
-
-func shouldIgnoreDiagnosisStreamError(err error) bool {
-	if err == nil {
-		return false
-	}
-	if errors.Is(err, context.Canceled) {
-		return true
-	}
-	msg := strings.ToLower(strings.TrimSpace(err.Error()))
-	if strings.Contains(msg, "broken pipe") || strings.Contains(msg, "connection reset by peer") {
-		return true
-	}
-	if strings.Contains(msg, "stream already closed") {
-		return true
-	}
-	return false
-}
-
-func (h *Handler) streamDiagnosisRuntime(ctx context.Context, cancel context.CancelFunc, w http.ResponseWriter, startPayload map[string]interface{}, workItems []diagnosisWorkItem) error {
-	flusher, err := prepareDiagnosisStreamResponse(w)
-	if err != nil {
-		return err
-	}
-	encoder := json.NewEncoder(w)
-
-	payload := map[string]interface{}{
-		"total":     len(workItems),
-		"timestamp": time.Now().UnixMilli(),
-		"items":     h.buildDiagnosisStreamStartItems(workItems),
-	}
-	for key, value := range startPayload {
-		payload[key] = value
-	}
-	if err := writeDiagnosisStreamEvent(encoder, flusher, "start", payload); err != nil {
-		return err
-	}
-
-	streamBroken := false
-	emitter := func(index int, item map[string]interface{}, progress diagnosisProgress) {
-		if streamBroken {
-			return
-		}
-		itemPayload := map[string]interface{}{
-			"index":    index,
-			"result":   item,
-			"progress": progress,
-		}
-		if err := writeDiagnosisStreamEvent(encoder, flusher, "item", itemPayload); err != nil {
-			streamBroken = true
-			if cancel != nil {
-				cancel()
-			}
-		}
-	}
-
-	results := h.runDiagnosisWorkItems(ctx, workItems, emitter)
-	if streamBroken {
-		return context.Canceled
-	}
-
-	progress := summarizeDiagnosisProgress(results)
-	donePayload := map[string]interface{}{
-		"progress": progress,
-		"timedOut": errors.Is(ctx.Err(), context.DeadlineExceeded),
-	}
-	return writeDiagnosisStreamEvent(encoder, flusher, "done", donePayload)
-}
-
-func (h *Handler) tunnelDiagnoseStream(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
-		response.WriteJSON(w, response.ErrDefault("请求失败"))
-		return
-	}
-	id := asInt64FromBodyKey(r, w, "tunnelId")
-	if id <= 0 {
-		return
-	}
-
-	tunnelName, tunnelType, workItems, err := h.prepareTunnelDiagnosis(id)
-	if err != nil {
-		if strings.Contains(err.Error(), "不存在") || strings.Contains(err.Error(), "不完整") {
-			response.WriteJSON(w, response.ErrDefault(err.Error()))
-			return
-		}
-		response.WriteJSON(w, response.Err(-2, err.Error()))
-		return
-	}
-
-	ctx, cancel := context.WithTimeout(r.Context(), diagnosisRequestTimeout)
-	defer cancel()
-
-	startPayload := map[string]interface{}{
-		"tunnelName": tunnelName,
-		"tunnelType": tunnelType,
-	}
-	if err := h.streamDiagnosisRuntime(ctx, cancel, w, startPayload, workItems); err != nil {
-		if shouldIgnoreDiagnosisStreamError(err) {
-			return
-		}
-		if strings.Contains(err.Error(), "不支持流式响应") {
-			response.WriteJSON(w, response.ErrDefault(err.Error()))
-			return
-		}
-		return
-	}
-}
-
-func (h *Handler) forwardDiagnoseStream(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
-		response.WriteJSON(w, response.ErrDefault("请求失败"))
-		return
-	}
-	id := asInt64FromBodyKey(r, w, "forwardId")
-	if id <= 0 {
-		return
-	}
-
-	forward, _, _, err := h.resolveForwardAccess(r, id)
-	if err != nil {
-		if errors.Is(err, errForwardNotFound) {
-			response.WriteJSON(w, response.ErrDefault("转发不存在"))
-			return
-		}
-		response.WriteJSON(w, response.Err(-2, err.Error()))
-		return
-	}
-
-	forwardName, workItems, err := h.prepareForwardDiagnosis(forward)
-	if err != nil {
-		if strings.Contains(err.Error(), "不存在") || strings.Contains(err.Error(), "不能为空") || strings.Contains(err.Error(), "错误") {
-			response.WriteJSON(w, response.ErrDefault(err.Error()))
-			return
-		}
-		response.WriteJSON(w, response.Err(-2, err.Error()))
-		return
-	}
-
-	ctx, cancel := context.WithTimeout(r.Context(), diagnosisRequestTimeout)
-	defer cancel()
-
-	startPayload := map[string]interface{}{
-		"forwardName": forwardName,
-	}
-	if err := h.streamDiagnosisRuntime(ctx, cancel, w, startPayload, workItems); err != nil {
-		if shouldIgnoreDiagnosisStreamError(err) {
-			return
-		}
-		if strings.Contains(err.Error(), "不支持流式响应") {
-			response.WriteJSON(w, response.ErrDefault(err.Error()))
-			return
-		}
-		return
-	}
-}
@@ -8,51 +8,9 @@ import (
 // nodeSupportsV4 / nodeSupportsV6
 // ---------------------------------------------------------------------------

-func TestSelectTunnelDialHost_ConnectIpPriority(t *testing.T) {
-	from := dualStackNode("from", "10.0.0.1", "2001:db8::1")
-	to := dualStackNode("to", "10.0.0.2", "2001:db8::2")
-
-	// Empty connectIp should be ignored, IP preference takes effect
-	host, err := selectTunnelDialHost(from, to, "", "")
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if host != "10.0.0.2" {
-		t.Fatalf("empty connectIp should be ignored (v4 preference applies), got %q", host)
-	}
-	// Non-empty connectIp should override IP preference
-	host, err = selectTunnelDialHost(from, to, "v6", "192.168.0.3")
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if host != "192.168.0.3" {
-		t.Fatalf("connectIp should override v6 preference, got %q", host)
-	}
-}
-
-func TestBuildTunnelChainServiceConfig_UsesConnectIPForListen(t *testing.T) {
-	node := &nodeRecord{TCPListenAddr: "[::]"}
-	chain := tunnelRuntimeNode{Protocol: "tls", Port: 21000, ConnectIP: "2001:db8::88"}
-	services := buildTunnelChainServiceConfig(99, chain, node)
-	if len(services) != 1 {
-		t.Fatalf("expected 1 service, got %d", len(services))
-	}
-	addr, _ := services[0]["addr"].(string)
-	if addr != "[2001:db8::88]:21000" {
-		t.Fatalf("expected connectIp listen [2001:db8::88]:21000, got %q", addr)
-	}
-}
-
-func TestBuildTunnelChainServiceConfig_DefaultListenAddrWhenConnectIPEmpty(t *testing.T) {
-	node := &nodeRecord{TCPListenAddr: "[::]"}
-	chain := tunnelRuntimeNode{Protocol: "tls", Port: 21001}
-	services := buildTunnelChainServiceConfig(99, chain, node)
-	if len(services) != 1 {
-		t.Fatalf("expected 1 service, got %d", len(services))
-	}
-	addr, _ := services[0]["addr"].(string)
-	if addr != "[::]:21001" {
-		t.Fatalf("expected default listen [::]:21001, got %q", addr)
+func TestNodeSupportsV4_Nil(t *testing.T) {
+	if nodeSupportsV4(nil) {
+		t.Fatal("nil node must not support v4")
 	}
 }

@@ -65,14 +23,14 @@ func TestNodeSupportsV6_Nil(t *testing.T) {
 func TestNodeSupportsV4_ExplicitV4(t *testing.T) {
 	n := &nodeRecord{ServerIPv4: "10.0.0.1"}
 	if !nodeSupportsV4(n) {
-		t.Fatal("explicit server_ip_v4 needs support v4")
+		t.Fatal("explicit server_ip_v4 must support v4")
 	}
 }

 func TestNodeSupportsV6_ExplicitV6(t *testing.T) {
 	n := &nodeRecord{ServerIPv6: "2001:db8::1"}
 	if !nodeSupportsV6(n) {
-		t.Fatal("explicit server_ip_v6 needs support v6")
+		t.Fatal("explicit server_ip_v6 must support v6")
 	}
 }

@@ -110,7 +68,7 @@ func TestNodeSupportsV4_LegacyV4Only(t *testing.T) {
 		t.Fatal("legacy v4 ip in server_ip must support v4")
 	}
 	if nodeSupportsV6(n) {
-		t.Fatal("legacy v4 ip in server_ip should not support v6")
+		t.Fatal("legacy v4 ip in server_ip must not support v6")
 	}
 }

@@ -120,7 +78,7 @@ func TestNodeSupportsV6_LegacyV6Only(t *testing.T) {
 		t.Fatal("legacy v6 ip in server_ip must support v6")
 	}
 	if nodeSupportsV4(n) {
-		t.Fatal("legacy v6 ip in server_ip should not support v4")
+		t.Fatal("legacy v6 ip in server_ip must not support v4")
 	}
 }

@@ -219,15 +177,15 @@ func v6OnlyNode(name, v6 string) *nodeRecord {
 }

 func TestSelectTunnelDialHost_NilNodes(t *testing.T) {
-	_, err := selectTunnelDialHost(nil, nil, "", "")
+	_, err := selectTunnelDialHost(nil, nil, "")
 	if err == nil {
 		t.Fatal("expected error for nil nodes")
 	}
-	_, err = selectTunnelDialHost(dualStackNode("a", "1.1.1.1", "::1"), nil, "", "")
+	_, err = selectTunnelDialHost(dualStackNode("a", "1.1.1.1", "::1"), nil, "")
 	if err == nil {
 		t.Fatal("expected error for nil toNode")
 	}
-	_, err = selectTunnelDialHost(nil, dualStackNode("b", "1.1.1.1", "::1"), "", "")
+	_, err = selectTunnelDialHost(nil, dualStackNode("b", "1.1.1.1", "::1"), "")
 	if err == nil {
 		t.Fatal("expected error for nil fromNode")
 	}
@@ -236,7 +194,8 @@ func TestSelectTunnelDialHost_NilNodes(t *testing.T) {
 func TestSelectTunnelDialHost_DualStack_DefaultPreference(t *testing.T) {
 	from := dualStackNode("from", "10.0.0.1", "2001:db8::1")
 	to := dualStackNode("to", "10.0.0.2", "2001:db8::2")
-	host, err := selectTunnelDialHost(from, to, "", "")
+
+	host, err := selectTunnelDialHost(from, to, "")
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
@@ -249,7 +208,8 @@ func TestSelectTunnelDialHost_DualStack_DefaultPreference(t *testing.T) {
 func TestSelectTunnelDialHost_DualStack_PreferV4(t *testing.T) {
 	from := dualStackNode("from", "10.0.0.1", "2001:db8::1")
 	to := dualStackNode("to", "10.0.0.2", "2001:db8::2")
-	host, err := selectTunnelDialHost(from, to, "v4", "")
+
+	host, err := selectTunnelDialHost(from, to, "v4")
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
@@ -261,7 +221,8 @@ func TestSelectTunnelDialHost_DualStack_PreferV4(t *testing.T) {
 func TestSelectTunnelDialHost_DualStack_PreferV6(t *testing.T) {
 	from := dualStackNode("from", "10.0.0.1", "2001:db8::1")
 	to := dualStackNode("to", "10.0.0.2", "2001:db8::2")
-	host, err := selectTunnelDialHost(from, to, "v6", "")
+
+	host, err := selectTunnelDialHost(from, to, "v6")
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
@@ -273,8 +234,9 @@ func TestSelectTunnelDialHost_DualStack_PreferV6(t *testing.T) {
 func TestSelectTunnelDialHost_V4Only_PreferV6Fallback(t *testing.T) {
 	from := v4OnlyNode("from", "10.0.0.1")
 	to := v4OnlyNode("to", "10.0.0.2")
+
 	// User prefers v6, but both nodes are v4-only — should fallback to v4
-	host, err := selectTunnelDialHost(from, to, "v6", "")
+	host, err := selectTunnelDialHost(from, to, "v6")
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
@@ -286,8 +248,9 @@ func TestSelectTunnelDialHost_V4Only_PreferV6Fallback(t *testing.T) {
 func TestSelectTunnelDialHost_V6Only_PreferV4Fallback(t *testing.T) {
 	from := v6OnlyNode("from", "2001:db8::1")
 	to := v6OnlyNode("to", "2001:db8::2")
+
 	// User prefers v4, but both nodes are v6-only — should fallback to v6
-	host, err := selectTunnelDialHost(from, to, "v4", "")
+	host, err := selectTunnelDialHost(from, to, "v4")
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
@@ -299,7 +262,8 @@ func TestSelectTunnelDialHost_V6Only_PreferV4Fallback(t *testing.T) {
 func TestSelectTunnelDialHost_Incompatible(t *testing.T) {
 	from := v4OnlyNode("from", "10.0.0.1")
 	to := v6OnlyNode("to", "2001:db8::2")
-	_, err := selectTunnelDialHost(from, to, "", "")
+
+	_, err := selectTunnelDialHost(from, to, "")
 	if err == nil {
 		t.Fatal("expected error for incompatible nodes (v4-only -> v6-only)")
 	}
@@ -308,7 +272,8 @@ func TestSelectTunnelDialHost_Incompatible(t *testing.T) {
 func TestSelectTunnelDialHost_Incompatible_Reverse(t *testing.T) {
 	from := v6OnlyNode("from", "2001:db8::1")
 	to := v4OnlyNode("to", "10.0.0.2")
-	_, err := selectTunnelDialHost(from, to, "", "")
+
+	_, err := selectTunnelDialHost(from, to, "")
 	if err == nil {
 		t.Fatal("expected error for incompatible nodes (v6-only -> v4-only)")
 	}
@@ -317,8 +282,9 @@ func TestSelectTunnelDialHost_Incompatible_Reverse(t *testing.T) {
 func TestSelectTunnelDialHost_WhitespacePreference(t *testing.T) {
 	from := dualStackNode("from", "10.0.0.1", "2001:db8::1")
 	to := dualStackNode("to", "10.0.0.2", "2001:db8::2")
+
 	// Whitespace should be trimmed, treated as "v6"
-	host, err := selectTunnelDialHost(from, to, "  v6  ", "")
+	host, err := selectTunnelDialHost(from, to, "  v6  ")
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
@@ -330,8 +296,9 @@ func TestSelectTunnelDialHost_WhitespacePreference(t *testing.T) {
 func TestSelectTunnelDialHost_MixedStack_FromDualToV4(t *testing.T) {
 	from := dualStackNode("from", "10.0.0.1", "2001:db8::1")
 	to := v4OnlyNode("to", "10.0.0.2")
+
 	// v6 preferred, but target only has v4 — should succeed with v4
-	host, err := selectTunnelDialHost(from, to, "v6", "")
+	host, err := selectTunnelDialHost(from, to, "v6")
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
@@ -343,8 +310,9 @@ func TestSelectTunnelDialHost_MixedStack_FromDualToV4(t *testing.T) {
 func TestSelectTunnelDialHost_MixedStack_FromDualToV6(t *testing.T) {
 	from := dualStackNode("from", "10.0.0.1", "2001:db8::1")
 	to := v6OnlyNode("to", "2001:db8::2")
+
 	// v4 preferred, but target only has v6 — should succeed with v6
-	host, err := selectTunnelDialHost(from, to, "v4", "")
+	host, err := selectTunnelDialHost(from, to, "v4")
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
@@ -356,8 +324,9 @@ func TestSelectTunnelDialHost_MixedStack_FromDualToV6(t *testing.T) {
 func TestSelectTunnelDialHost_MixedStack_FromV4ToDual(t *testing.T) {
 	from := v4OnlyNode("from", "10.0.0.1")
 	to := dualStackNode("to", "10.0.0.2", "2001:db8::2")
+
 	// v6 preferred, but from only has v4 — should use v4 (from can only reach v4 of target)
-	host, err := selectTunnelDialHost(from, to, "v6", "")
+	host, err := selectTunnelDialHost(from, to, "v6")
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
@@ -369,8 +338,9 @@ func TestSelectTunnelDialHost_MixedStack_FromV4ToDual(t *testing.T) {
 func TestSelectTunnelDialHost_MixedStack_FromV6ToDual(t *testing.T) {
 	from := v6OnlyNode("from", "2001:db8::1")
 	to := dualStackNode("to", "10.0.0.2", "2001:db8::2")
+
 	// v4 preferred, but from only has v6 — should use v6
-	host, err := selectTunnelDialHost(from, to, "v4", "")
+	host, err := selectTunnelDialHost(from, to, "v4")
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
@@ -397,6 +367,7 @@ func TestNodeDisplayName_Named(t *testing.T) {
 		t.Fatalf("expected 'hk-node', got %q", got)
 	}
 }
+
 func TestNodeDisplayName_Unnamed(t *testing.T) {
 	n := &nodeRecord{ID: 42}
 	got := nodeDisplayName(n)
@@ -1,6 +1,7 @@
 package handler

 import (
+	"database/sql"
 	"encoding/json"
 	"fmt"
 	"net"
@@ -13,7 +14,7 @@ import (

 	"go-backend/internal/http/client"
 	"go-backend/internal/http/response"
-	"go-backend/internal/store/repo"
+	"go-backend/internal/store/sqlite"
 )

 type federationTunnelRequest struct {
@@ -107,7 +108,7 @@ type peerShareUsedPort struct {
 }

 type peerShareListItem struct {
-	repo.PeerShare
+	sqlite.PeerShare
 	UsedPorts        []int               `json:"usedPorts"`
 	UsedPortDetails  []peerShareUsedPort `json:"usedPortDetails"`
 	ActiveRuntimeNum int                 `json:"activeRuntimeNum"`
@@ -263,7 +264,7 @@ func (h *Handler) federationShareCreate(w http.ResponseWriter, r *http.Request)
 	now := time.Now().UnixMilli()
 	token := randomToken(32)

-	share := &repo.PeerShare{
+	share := &sqlite.PeerShare{
 		Name:           req.Name,
 		NodeID:         req.NodeID,
 		Token:          token,
@@ -429,25 +430,40 @@ func (h *Handler) federationRemoteUsageList(w http.ResponseWriter, r *http.Reque
 		return
 	}

-	remoteNodes, err := h.repo.ListRemoteNodes()
+	rows, err := h.repo.DB().Query(`
+		SELECT id, name, remote_url, remote_token, remote_config
+		FROM node
+		WHERE is_remote = 1
+		ORDER BY id DESC
+	`)
 	if err != nil {
 		response.WriteJSON(w, response.Err(-2, err.Error()))
 		return
 	}
+	defer rows.Close()

 	fc := client.NewFederationClient()
 	localDomain := h.federationLocalDomain()

 	items := make([]remoteUsageNodeItem, 0)
-	for _, node := range remoteNodes {
-		nodeID := node.ID
-		nodeName := node.Name
+	for rows.Next() {
+		var (
+			nodeID       int64
+			nodeName     string
+			remoteURL    sql.NullString
+			remoteToken  sql.NullString
+			remoteConfig sql.NullString
+		)
+		if err := rows.Scan(&nodeID, &nodeName, &remoteURL, &remoteToken, &remoteConfig); err != nil {
+			response.WriteJSON(w, response.Err(-2, err.Error()))
+			return
+		}

-		shareID, maxBandwidth, currentFlow, expiryTime, portRangeStart, portRangeEnd := parseRemoteShareUsageConfig(node.RemoteConfig.String)
+		shareID, maxBandwidth, currentFlow, expiryTime, portRangeStart, portRangeEnd := parseRemoteShareUsageConfig(remoteConfig.String)

 		var syncError string
-		url := strings.TrimSpace(node.RemoteURL.String)
-		token := strings.TrimSpace(node.RemoteToken.String)
+		url := strings.TrimSpace(remoteURL.String)
+		token := strings.TrimSpace(remoteToken.String)
 		if url != "" && token != "" {
 			info, connectErr := fc.Connect(url, token, localDomain)
 			if connectErr != nil {
@@ -468,62 +484,42 @@ func (h *Handler) federationRemoteUsageList(w http.ResponseWriter, r *http.Reque
 					"portRangeStart": info.PortRangeStart,
 					"portRangeEnd":   info.PortRangeEnd,
 				})
-				_ = h.repo.UpdateNodeRemoteConfig(nodeID, string(configData))
+				_, _ = h.repo.DB().Exec(`UPDATE node SET remote_config = ? WHERE id = ?`, string(configData), nodeID)
 			}
 		}

-		bindingRows, err := h.repo.ListActiveBindingsForNode(nodeID)
-		if err != nil {
-			response.WriteJSON(w, response.Err(-2, err.Error()))
-			return
-		}
-		forwardPortRows, err := h.repo.ListActiveForwardPortsForNode(nodeID)
+		bindingRows, err := h.repo.DB().Query(`
+			SELECT fb.id, fb.tunnel_id, COALESCE(t.name, ''), fb.chain_type, fb.hop_inx, fb.allocated_port, fb.resource_key, fb.remote_binding_id, fb.updated_time
+			FROM federation_tunnel_binding fb
+			LEFT JOIN tunnel t ON t.id = fb.tunnel_id
+			WHERE fb.node_id = ? AND fb.status = 1
+			ORDER BY fb.allocated_port ASC, fb.id ASC
+		`, nodeID)
 		if err != nil {
 			response.WriteJSON(w, response.Err(-2, err.Error()))
 			return
 		}

 		usedSet := make(map[int]struct{})
-		bindings := make([]remoteUsageBindingItem, 0, len(bindingRows)+len(forwardPortRows))
-		for _, b := range bindingRows {
-			bindings = append(bindings, remoteUsageBindingItem{
-				BindingID:       b.ID,
-				TunnelID:        b.TunnelID,
-				TunnelName:      b.TunnelName,
-				ChainType:       b.ChainType,
-				HopInx:          b.HopInx,
-				AllocatedPort:   b.AllocatedPort,
-				ResourceKey:     b.ResourceKey,
-				RemoteBindingID: b.RemoteBindingID,
-				UpdatedTime:     b.UpdatedTime,
-			})
-			if b.AllocatedPort > 0 {
-				usedSet[b.AllocatedPort] = struct{}{}
+		bindings := make([]remoteUsageBindingItem, 0)
+		for bindingRows.Next() {
+			var item remoteUsageBindingItem
+			if err := bindingRows.Scan(&item.BindingID, &item.TunnelID, &item.TunnelName, &item.ChainType, &item.HopInx, &item.AllocatedPort, &item.ResourceKey, &item.RemoteBindingID, &item.UpdatedTime); err != nil {
+				_ = bindingRows.Close()
+				response.WriteJSON(w, response.Err(-2, err.Error()))
+				return
+			}
+			bindings = append(bindings, item)
+			if item.AllocatedPort > 0 {
+				usedSet[item.AllocatedPort] = struct{}{}
 			}
 		}
-		for _, fp := range forwardPortRows {
-			bindings = append(bindings, remoteUsageBindingItem{
-				BindingID:       -fp.ForwardID,
-				TunnelID:        fp.TunnelID,
-				TunnelName:      fp.TunnelName,
-				ChainType:       1,
-				HopInx:          0,
-				AllocatedPort:   fp.Port,
-				ResourceKey:     fmt.Sprintf("forward:%d", fp.ForwardID),
-				RemoteBindingID: "",
-				UpdatedTime:     fp.UpdatedTime,
-			})
-			if fp.Port > 0 {
-				usedSet[fp.Port] = struct{}{}
-			}
+		if err := bindingRows.Err(); err != nil {
+			_ = bindingRows.Close()
+			response.WriteJSON(w, response.Err(-2, err.Error()))
+			return
 		}
-
-		sort.Slice(bindings, func(i, j int) bool {
-			if bindings[i].AllocatedPort == bindings[j].AllocatedPort {
-				return bindings[i].BindingID < bindings[j].BindingID
-			}
-			return bindings[i].AllocatedPort < bindings[j].AllocatedPort
-		})
+		_ = bindingRows.Close()

 		usedPorts := make([]int, 0, len(usedSet))
 		for port := range usedSet {
@@ -547,6 +543,10 @@ func (h *Handler) federationRemoteUsageList(w http.ResponseWriter, r *http.Reque
 			SyncError:        syncError,
 		})
 	}
+	if err := rows.Err(); err != nil {
+		response.WriteJSON(w, response.Err(-2, err.Error()))
+		return
+	}

 	response.WriteJSON(w, response.OK(items))
 }
@@ -639,21 +639,31 @@ func (h *Handler) nodeImport(w http.ResponseWriter, r *http.Request) {
 		portRange = fmt.Sprintf("%d-%d", info.PortRangeStart, info.PortRangeEnd)
 	}

-	inx := h.repo.NextIndex("node")
+	db := h.repo.DB()
+	inx := nextIndex(db, "node")
 	now := time.Now().UnixMilli()

-	if err = h.repo.CreateRemoteNode(
+	_, err = db.Exec(`
+		INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx, is_remote, remote_url, remote_token, remote_config)
+		VALUES(?, ?, ?, ?, ?, ?, ?, ?, 0, 0, 0, ?, ?, ?, ?, ?, ?, 1, ?, ?, ?)
+	`,
 		fmt.Sprintf("%s (Remote)", info.NodeName),
-		randomToken(16),
+		randomToken(16), // Dummy secret
 		info.ServerIP,
+		"", "", // v4/v6 unknown, use server_ip
 		portRange,
-		now,
+		"",
+		"",
+		now, now,
 		info.Status,
+		"[::]", "[::]",
 		inx,
 		req.RemoteURL,
 		req.Token,
 		string(configBytes),
-	); err != nil {
+	)
+
+	if err != nil {
 		response.WriteJSON(w, response.Err(-2, "Database error: "+err.Error()))
 		return
 	}
@@ -745,7 +755,11 @@ func (h *Handler) federationConnect(w http.ResponseWriter, r *http.Request) {
 		return
 	}

-	nodeInfo, err := h.repo.GetNodeBasicInfo(share.NodeID)
+	var nodeName string
+	var serverIP string
+	var status int
+
+	err = h.repo.DB().QueryRow("SELECT name, server_ip, status FROM node WHERE id = ?", share.NodeID).Scan(&nodeName, &serverIP, &status)
 	if err != nil {
 		response.WriteJSON(w, response.Err(-2, "Node not found"))
 		return
@@ -755,9 +769,9 @@ func (h *Handler) federationConnect(w http.ResponseWriter, r *http.Request) {
 		"shareId":        share.ID,
 		"shareName":      share.Name,
 		"nodeId":         share.NodeID,
-		"nodeName":       nodeInfo.Name,
-		"serverIp":       nodeInfo.ServerIP,
-		"status":         nodeInfo.Status,
+		"nodeName":       nodeName,
+		"serverIp":       serverIP,
+		"status":         status,
 		"maxBandwidth":   share.MaxBandwidth,
 		"currentFlow":    share.CurrentFlow,
 		"expiryTime":     share.ExpiryTime,
@@ -794,71 +808,41 @@ func (h *Handler) federationTunnelCreate(w http.ResponseWriter, r *http.Request)
 		return
 	}

-	usedPorts, err := h.repo.ListUsedPortsOnNode(share.NodeID)
-	if err != nil {
-		response.WriteJSON(w, response.Err(-2, err.Error()))
-		return
-	}
-	for _, port := range usedPorts {
-		if port == req.RemotePort {
-			response.WriteJSON(w, response.Err(403, "Port already in use"))
-			return
-		}
-	}
+	tunnelType := 1

-	runtimeOnPort, err := h.repo.GetActiveForwardPeerShareRuntimeByPort(share.ID, req.RemotePort)
+	tx, err := h.repo.DB().Begin()
 	if err != nil {
 		response.WriteJSON(w, response.Err(-2, err.Error()))
 		return
 	}
-	if runtimeOnPort != nil {
-		response.WriteJSON(w, response.Err(403, "Port already in use"))
-		return
-	}
-	existsOnNodePort, err := h.repo.ExistsActivePeerShareRuntimeOnNodePort(share.NodeID, req.RemotePort)
-	if err != nil {
-		response.WriteJSON(w, response.Err(-2, err.Error()))
-		return
-	}
-	if existsOnNodePort {
-		response.WriteJSON(w, response.Err(403, "Port already in use"))
-		return
-	}
+	defer tx.Rollback()

 	now := time.Now().UnixMilli()
-	tunnelID, err := h.repo.CreateFederationTunnel(
+	tunnelID, err := tx.ExecReturningID(`INSERT INTO tunnel (name, type, protocol, flow, created_time, updated_time, status, in_ip) VALUES (?, ?, ?, 0, ?, ?, 1, ?)`,
 		fmt.Sprintf("Share-%d-Port-%d", share.ID, req.RemotePort),
-		1,
+		tunnelType,
 		req.Protocol,
 		now,
-		share.NodeID,
-		req.RemotePort,
+		now,
+		"",
 	)
 	if err != nil {
 		response.WriteJSON(w, response.Err(-2, err.Error()))
 		return
 	}

-	runtime := &repo.PeerShareRuntime{
-		ShareID:       share.ID,
-		NodeID:        share.NodeID,
-		ReservationID: randomToken(24),
-		ResourceKey:   fmt.Sprintf("federation-forward-%d-%d-%d", share.ID, tunnelID, req.RemotePort),
-		BindingID:     "",
-		Role:          "forward",
-		ChainName:     "",
-		ServiceName:   "",
-		Protocol:      defaultString(req.Protocol, "tcp"),
-		Strategy:      "fifo",
-		Port:          req.RemotePort,
-		Target:        strings.TrimSpace(req.Target),
-		Applied:       0,
-		Status:        1,
-		CreatedTime:   now,
-		UpdatedTime:   now,
+	_, err = tx.Exec(`INSERT INTO chain_tunnel (tunnel_id, chain_type, node_id, port, strategy, inx, protocol) VALUES (?, '1', ?, ?, 'fifo', 0, ?)`,
+		tunnelID,
+		share.NodeID,
+		req.RemotePort,
+		req.Protocol,
+	)
+	if err != nil {
+		response.WriteJSON(w, response.Err(-2, err.Error()))
+		return
 	}
-	if err := h.repo.CreatePeerShareRuntime(runtime); err != nil {
-		_ = h.deleteTunnelByID(tunnelID)
+
+	if err := tx.Commit(); err != nil {
 		response.WriteJSON(w, response.Err(-2, err.Error()))
 		return
 	}
@@ -943,7 +927,7 @@ func (h *Handler) federationRuntimeReservePort(w http.ResponseWriter, r *http.Re
 		return
 	}

-	runtime := &repo.PeerShareRuntime{
+	runtime := &sqlite.PeerShareRuntime{
 		ShareID:       share.ID,
 		NodeID:        share.NodeID,
 		ReservationID: randomToken(24),
@@ -997,7 +981,7 @@ func (h *Handler) federationRuntimeApplyRole(w http.ResponseWriter, r *http.Requ
 		return
 	}

-	var runtime *repo.PeerShareRuntime
+	var runtime *sqlite.PeerShareRuntime
 	if strings.TrimSpace(req.ReservationID) != "" {
 		runtime, err = h.repo.GetPeerShareRuntimeByReservationID(share.ID, strings.TrimSpace(req.ReservationID))
 	} else {
@@ -1168,7 +1152,7 @@ func (h *Handler) federationRuntimeReleaseRole(w http.ResponseWriter, r *http.Re
 		return
 	}

-	var runtime *repo.PeerShareRuntime
+	var runtime *sqlite.PeerShareRuntime
 	if strings.TrimSpace(req.BindingID) != "" {
 		runtime, err = h.repo.GetPeerShareRuntimeByBindingID(share.ID, strings.TrimSpace(req.BindingID))
 	} else if strings.TrimSpace(req.ReservationID) != "" {
@@ -1232,20 +1216,16 @@ func (h *Handler) federationRuntimeDiagnose(w http.ResponseWriter, r *http.Reque
 	if req.Count <= 0 {
 		req.Count = 4
 	}
-	if req.Timeout <= 0 || req.Timeout > int(diagnosisCommandTimeout/time.Millisecond) {
-		req.Timeout = int(diagnosisCommandTimeout / time.Millisecond)
-	}
-	commandTimeout := time.Duration(req.Timeout) * time.Millisecond
-	if commandTimeout <= 0 || commandTimeout > diagnosisCommandTimeout {
-		commandTimeout = diagnosisCommandTimeout
+	if req.Timeout <= 0 {
+		req.Timeout = 5000
 	}

-	res, err := h.sendNodeCommandWithTimeout(share.NodeID, "TcpPing", map[string]interface{}{
+	res, err := h.sendNodeCommand(share.NodeID, "TcpPing", map[string]interface{}{
 		"ip":      req.IP,
 		"port":    req.Port,
 		"count":   req.Count,
 		"timeout": req.Timeout,
-	}, commandTimeout, false, false)
+	}, false, false)
 	if err != nil {
 		response.WriteJSON(w, response.ErrDefault(err.Error()))
 		return
@@ -1298,185 +1278,12 @@ func (h *Handler) federationRuntimeCommand(w http.ResponseWriter, r *http.Reques
 		response.WriteJSON(w, response.ErrDefault(err.Error()))
 		return
 	}
-	if strings.EqualFold(cmd, "addservice") || strings.EqualFold(cmd, "updateservice") {
-		h.bindPeerShareForwardRuntimeServices(share, req.Data)
-	} else if strings.EqualFold(cmd, "deleteservice") {
-		h.releasePeerShareForwardRuntimeServices(share, req.Data)
-	}
 	response.WriteJSON(w, response.OK(res))
 }

-type federationForwardServiceBinding struct {
-	Name string
-	Port int
-}
-
-func extractFederationServiceEntries(data interface{}) []map[string]interface{} {
-	if data == nil {
-		return nil
-	}
-
-	if entries := asMapSlice(data); len(entries) > 0 {
-		return entries
-	}
-
-	dataMap, ok := data.(map[string]interface{})
-	if !ok {
-		return nil
-	}
-
-	if entries := asMapSlice(dataMap["services"]); len(entries) > 0 {
-		return entries
-	}
-
-	return nil
-}
-
-func parseFederationForwardServiceBindings(data interface{}) []federationForwardServiceBinding {
-	serviceList := extractFederationServiceEntries(data)
-	bindings := make([]federationForwardServiceBinding, 0, len(serviceList))
-	for _, svcMap := range serviceList {
-		name := normalizeForwardRuntimeServiceName(asString(svcMap["name"]))
-		if name == "" {
-			continue
-		}
-		if _, _, _, ok := parseFlowServiceIDs(name); !ok {
-			continue
-		}
-		addr := strings.TrimSpace(asString(svcMap["addr"]))
-		if addr == "" {
-			continue
-		}
-		_, portStr, err := net.SplitHostPort(addr)
-		if err != nil {
-			continue
-		}
-		port, err := strconv.Atoi(portStr)
-		if err != nil || port <= 0 {
-			continue
-		}
-		bindings = append(bindings, federationForwardServiceBinding{Name: name, Port: port})
-	}
-	return bindings
-}
-
-func parseFederationForwardServiceNamesForRelease(data interface{}) []string {
-	names := make(map[string]struct{})
-	appendName := func(raw string) {
-		name := normalizeForwardRuntimeServiceName(raw)
-		if name == "" {
-			return
-		}
-		if _, _, _, ok := parseFlowServiceIDs(name); !ok {
-			return
-		}
-		names[name] = struct{}{}
-	}
-
-	for _, svcMap := range extractFederationServiceEntries(data) {
-		appendName(asString(svcMap["name"]))
-	}
-
-	if dataMap, ok := data.(map[string]interface{}); ok {
-		for _, item := range asAnySlice(dataMap["services"]) {
-			appendName(asString(item))
-		}
-	}
-
-	for _, item := range asAnySlice(data) {
-		appendName(asString(item))
-	}
-
-	if len(names) == 0 {
-		return nil
-	}
-
-	out := make([]string, 0, len(names))
-	for name := range names {
-		out = append(out, name)
-	}
-	sort.Strings(out)
-	return out
-}
-
-func (h *Handler) bindPeerShareForwardRuntimeServices(share *repo.PeerShare, data interface{}) {
-	if h == nil || h.repo == nil || share == nil {
-		return
-	}
-	bindings := parseFederationForwardServiceBindings(data)
-	if len(bindings) == 0 {
-		return
-	}
-
-	now := time.Now().UnixMilli()
-	for _, binding := range bindings {
-		runtime, err := h.repo.GetActiveForwardPeerShareRuntimeByPort(share.ID, binding.Port)
-		if err != nil {
-			continue
-		}
-		if runtime == nil {
-			runtime, err = h.repo.GetActiveForwardPeerShareRuntimeByServiceName(share.ID, binding.Name)
-			if err != nil {
-				continue
-			}
-		}
-		if runtime == nil {
-			_ = h.repo.CreatePeerShareRuntime(&repo.PeerShareRuntime{
-				ShareID:       share.ID,
-				NodeID:        share.NodeID,
-				ReservationID: randomToken(24),
-				ResourceKey:   fmt.Sprintf("forward-runtime:%d:%s:%d:%s", share.ID, binding.Name, binding.Port, randomToken(8)),
-				BindingID:     "",
-				Role:          "forward",
-				ChainName:     "",
-				ServiceName:   binding.Name,
-				Protocol:      "tcp",
-				Strategy:      "fifo",
-				Port:          binding.Port,
-				Target:        "",
-				Applied:       1,
-				Status:        1,
-				CreatedTime:   now,
-				UpdatedTime:   now,
-			})
-			continue
-		}
-		if runtime.ServiceName == binding.Name && runtime.Applied == 1 && runtime.Port == binding.Port && runtime.Status == 1 {
-			continue
-		}
-		runtime.ServiceName = binding.Name
-		runtime.Port = binding.Port
-		runtime.Applied = 1
-		runtime.Status = 1
-		runtime.UpdatedTime = now
-		if strings.TrimSpace(runtime.Protocol) == "" {
-			runtime.Protocol = "tcp"
-		}
-		if strings.TrimSpace(runtime.Strategy) == "" {
-			runtime.Strategy = "fifo"
-		}
-		_ = h.repo.UpdatePeerShareRuntime(runtime)
-	}
-}
-
-func (h *Handler) releasePeerShareForwardRuntimeServices(share *repo.PeerShare, data interface{}) {
-	if h == nil || h.repo == nil || share == nil {
-		return
-	}
-	names := parseFederationForwardServiceNamesForRelease(data)
-	if len(names) == 0 {
-		return
-	}
-
-	now := time.Now().UnixMilli()
-	for _, name := range names {
-		_ = h.repo.MarkForwardPeerShareRuntimeReleasedByServiceName(share.ID, name, now)
-	}
-}
-
 func isFederationRuntimeCommandAllowed(commandType string) bool {
 	switch strings.ToLower(strings.TrimSpace(commandType)) {
-	case "addservice", "updateservice", "deleteservice", "pauseservice", "resumeservice", "addchains", "deletechains", "addlimiters", "updatelimiters", "deletelimiters", "tcpping", "reload":
+	case "addservice", "updateservice", "deleteservice", "pauseservice", "resumeservice", "addchains", "deletechains", "addlimiters", "deletelimiters", "tcpping", "reload":
 		return true
 	default:
 		return false
@@ -1492,37 +1299,47 @@ func isFederationServiceCommand(commandType string) bool {
 	}
 }

-func validateFederationCommandPorts(share *repo.PeerShare, data interface{}) error {
+func validateFederationCommandPorts(share *sqlite.PeerShare, data interface{}) error {
 	if share == nil || (share.PortRangeStart <= 0 && share.PortRangeEnd <= 0) {
 		return nil
 	}
-
-	serviceList := extractFederationServiceEntries(data)
-	if len(serviceList) == 0 {
+	dataMap, ok := data.(map[string]interface{})
+	if !ok {
 		return nil
 	}
-	for _, svcMap := range serviceList {
-		addr := asString(svcMap["addr"])
-		if addr == "" {
-			continue
+
+	if services, ok := dataMap["services"]; ok {
+		serviceList, ok := services.([]interface{})
+		if !ok {
+			return fmt.Errorf("invalid services format")
 		}
-		_, portStr, err := net.SplitHostPort(addr)
-		if err != nil {
-			return fmt.Errorf("invalid service address: %s", addr)
-		}
-		port, err := strconv.Atoi(portStr)
-		if err != nil || port <= 0 {
-			return fmt.Errorf("invalid port in service address: %s", addr)
-		}
-		if port < share.PortRangeStart || port > share.PortRangeEnd {
-			return fmt.Errorf("port %d out of allowed range %d-%d", port, share.PortRangeStart, share.PortRangeEnd)
+		for _, svc := range serviceList {
+			svcMap, ok := svc.(map[string]interface{})
+			if !ok {
+				return fmt.Errorf("invalid service entry format")
+			}
+			addr, ok := svcMap["addr"].(string)
+			if !ok || addr == "" {
+				continue
+			}
+			_, portStr, err := net.SplitHostPort(addr)
+			if err != nil {
+				return fmt.Errorf("invalid service address: %s", addr)
+			}
+			port, err := strconv.Atoi(portStr)
+			if err != nil || port <= 0 {
+				return fmt.Errorf("invalid port in service address: %s", addr)
+			}
+			if port < share.PortRangeStart || port > share.PortRangeEnd {
+				return fmt.Errorf("port %d out of allowed range %d-%d", port, share.PortRangeStart, share.PortRangeEnd)
+			}
 		}
 	}

 	return nil
 }

-func (h *Handler) pickPeerSharePort(share *repo.PeerShare, requestedPort int) (int, error) {
+func (h *Handler) pickPeerSharePort(share *sqlite.PeerShare, requestedPort int) (int, error) {
 	if share == nil {
 		return 0, fmt.Errorf("share not found")
 	}
@@ -1532,13 +1349,29 @@ func (h *Handler) pickPeerSharePort(share *repo.PeerShare, requestedPort int) (i

 	used := make(map[int]struct{})

-	nodePorts, err := h.repo.ListUsedPortsOnNode(share.NodeID)
+	rows, err := h.repo.DB().Query(`SELECT port FROM chain_tunnel WHERE node_id = ? AND port IS NOT NULL AND port > 0`, share.NodeID)
 	if err != nil {
 		return 0, err
 	}
-	for _, p := range nodePorts {
-		used[p] = struct{}{}
+	for rows.Next() {
+		var p sql.NullInt64
+		if scanErr := rows.Scan(&p); scanErr == nil && p.Valid && p.Int64 > 0 {
+			used[int(p.Int64)] = struct{}{}
+		}
 	}
+	_ = rows.Close()
+
+	rows, err = h.repo.DB().Query(`SELECT port FROM forward_port WHERE node_id = ? AND port > 0`, share.NodeID)
+	if err != nil {
+		return 0, err
+	}
+	for rows.Next() {
+		var p sql.NullInt64
+		if scanErr := rows.Scan(&p); scanErr == nil && p.Valid && p.Int64 > 0 {
+			used[int(p.Int64)] = struct{}{}
+		}
+	}
+	_ = rows.Close()

 	ports, err := h.repo.ListActivePeerShareRuntimePorts(share.ID, share.NodeID)
 	if err != nil {
@@ -1579,7 +1412,7 @@ func extractBearerToken(r *http.Request) string {
 	return ""
 }

-func isPeerShareFlowExceeded(share *repo.PeerShare) bool {
+func isPeerShareFlowExceeded(share *sqlite.PeerShare) bool {
 	if share == nil {
 		return false
 	}
@@ -1822,10 +1655,19 @@ func (h *Handler) cleanupFederationTunnels(shareID int64) {
 		return
 	}
 	namePrefix := fmt.Sprintf("Share-%d-Port-", shareID)
-	tunnelIDs, err := h.repo.ListTunnelIDsByNamePrefix(namePrefix)
-	if err != nil || len(tunnelIDs) == 0 {
+	rows, err := h.repo.DB().Query(`SELECT id FROM tunnel WHERE name LIKE ?`, namePrefix+"%")
+	if err != nil {
 		return
 	}
+	defer rows.Close()
+
+	var tunnelIDs []int64
+	for rows.Next() {
+		var id int64
+		if err := rows.Scan(&id); err == nil {
+			tunnelIDs = append(tunnelIDs, id)
+		}
+	}

 	for _, tid := range tunnelIDs {
 		_ = h.deleteTunnelByID(tid)
@@ -10,33 +10,33 @@ import (
 	"time"

 	"go-backend/internal/http/response"
-	"go-backend/internal/store/repo"
+	"go-backend/internal/store/sqlite"
 )

 func TestPickPeerSharePortUsesRuntimeReservations(t *testing.T) {
-	r, err := repo.Open(filepath.Join(t.TempDir(), "panel.db"))
+	repo, err := sqlite.Open(filepath.Join(t.TempDir(), "panel.db"))
 	if err != nil {
 		t.Fatalf("open repo: %v", err)
 	}
-	defer r.Close()
+	defer repo.Close()

-	h := &Handler{repo: r}
+	h := &Handler{repo: repo}
 	now := time.Now().UnixMilli()

-	if err := r.DB().Exec(`INSERT INTO chain_tunnel(tunnel_id, chain_type, node_id, port, strategy, inx, protocol) VALUES(?, ?, ?, ?, ?, ?, ?)`, 1, 2, 1, 3000, "round", 1, "tls").Error; err != nil {
+	if _, err := repo.DB().Exec(`INSERT INTO chain_tunnel(tunnel_id, chain_type, node_id, port, strategy, inx, protocol) VALUES(?, ?, ?, ?, ?, ?, ?)`, 1, 2, 1, 3000, "round", 1, "tls"); err != nil {
 		t.Fatalf("insert chain_tunnel: %v", err)
 	}
-	if err := r.DB().Exec(`INSERT INTO forward_port(forward_id, node_id, port) VALUES(?, ?, ?)`, 1, 1, 3001).Error; err != nil {
+	if _, err := repo.DB().Exec(`INSERT INTO forward_port(forward_id, node_id, port) VALUES(?, ?, ?)`, 1, 1, 3001); err != nil {
 		t.Fatalf("insert forward_port: %v", err)
 	}
-	if err := r.DB().Exec(`
+	if _, err := repo.DB().Exec(`
 		INSERT INTO peer_share_runtime(share_id, node_id, reservation_id, resource_key, binding_id, role, chain_name, service_name, protocol, strategy, port, target, applied, status, created_time, updated_time)
 		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, 77, 1, "res-1", "rk-1", "b-1", "exit", "", "fed_svc_1", "tls", "round", 3002, "", 1, 1, now, now).Error; err != nil {
+	`, 77, 1, "res-1", "rk-1", "b-1", "exit", "", "fed_svc_1", "tls", "round", 3002, "", 1, 1, now, now); err != nil {
 		t.Fatalf("insert peer_share_runtime: %v", err)
 	}

-	share := &repo.PeerShare{
+	share := &sqlite.PeerShare{
 		ID:             77,
 		NodeID:         1,
 		PortRangeStart: 3000,
@@ -57,13 +57,13 @@ func TestPickPeerSharePortUsesRuntimeReservations(t *testing.T) {
 }

 func TestApplyTunnelRuntimeSkipsRemoteChainAndOutNodes(t *testing.T) {
-	r, err := repo.Open(filepath.Join(t.TempDir(), "rt-skip.db"))
+	repo, err := sqlite.Open(filepath.Join(t.TempDir(), "rt-skip.db"))
 	if err != nil {
 		t.Fatalf("open repo: %v", err)
 	}
-	defer r.Close()
+	defer repo.Close()

-	h := &Handler{repo: r}
+	h := &Handler{repo: repo}
 	now := time.Now().UnixMilli()
 	for _, n := range []struct {
 		id   int64
@@ -73,10 +73,10 @@ func TestApplyTunnelRuntimeSkipsRemoteChainAndOutNodes(t *testing.T) {
 		{12, "remote-chain", "10.99.0.2"},
 		{13, "remote-out", "10.99.0.3"},
 	} {
-		if err := r.DB().Exec(`
+		if _, err := repo.DB().Exec(`
 			INSERT INTO node(id, name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx, is_remote, remote_url, remote_token)
 			VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-		`, n.id, n.name, n.name+"-secret", n.ip, n.ip, "", "40000-40010", "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", 0, 1, "http://remote-peer", "remote-token").Error; err != nil {
+		`, n.id, n.name, n.name+"-secret", n.ip, n.ip, "", "40000-40010", "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", 0, 1, "http://remote-peer", "remote-token"); err != nil {
 			t.Fatalf("insert node %s: %v", n.name, err)
 		}
 	}
@@ -112,34 +112,39 @@ func TestApplyTunnelRuntimeSkipsRemoteChainAndOutNodes(t *testing.T) {
 }

 func TestPrepareTunnelCreateStateRemoteAutoPortDefersToFederation(t *testing.T) {
-	r, err := repo.Open(filepath.Join(t.TempDir(), "panel.db"))
+	repo, err := sqlite.Open(filepath.Join(t.TempDir(), "panel.db"))
 	if err != nil {
 		t.Fatalf("open repo: %v", err)
 	}
-	defer r.Close()
+	defer repo.Close()

-	h := &Handler{repo: r}
+	h := &Handler{repo: repo}
 	now := time.Now().UnixMilli()

 	insertNode := func(name string, status int, portRange string, isRemote int) int64 {
-		if execErr := r.DB().Exec(`
+		res, execErr := repo.DB().Exec(`
 			INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx, is_remote, remote_url, remote_token, remote_config)
 			VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-		`, name, name+"-secret", "10.0.0.1", "10.0.0.1", "", portRange, "", "v1", 1, 1, 1, now, now, status, "[::]", "[::]", 0, isRemote, "http://peer", "peer-token", `{"shareId":1}`).Error; execErr != nil {
+		`, name, name+"-secret", "10.0.0.1", "10.0.0.1", "", portRange, "", "v1", 1, 1, 1, now, now, status, "[::]", "[::]", 0, isRemote, "http://peer", "peer-token", `{"shareId":1}`)
+		if execErr != nil {
 			t.Fatalf("insert node %s: %v", name, execErr)
 		}
-		return mustLastInsertID(t, r, name)
+		id, idErr := res.LastInsertId()
+		if idErr != nil {
+			t.Fatalf("node id %s: %v", name, idErr)
+		}
+		return id
 	}

 	entryID := insertNode("entry", 1, "31000-31010", 0)
 	remoteOutID := insertNode("remote-out", 1, "30000", 1)

-	if err := r.DB().Exec(`INSERT INTO forward_port(forward_id, node_id, port) VALUES(?, ?, ?)`, 1, remoteOutID, 30000).Error; err != nil {
+	if _, err := repo.DB().Exec(`INSERT INTO forward_port(forward_id, node_id, port) VALUES(?, ?, ?)`, 1, remoteOutID, 30000); err != nil {
 		t.Fatalf("insert forward_port: %v", err)
 	}

-	tx := r.DB().Begin()
-	if tx.Error != nil {
+	tx, err := repo.DB().Begin()
+	if err != nil {
 		t.Fatalf("begin tx: %v", err)
 	}
 	defer tx.Rollback()
@@ -168,31 +173,36 @@ func TestPrepareTunnelCreateStateRemoteAutoPortDefersToFederation(t *testing.T)
 }

 func TestPrepareTunnelCreateStateAllowsOfflineRemoteMiddleNode(t *testing.T) {
-	r, err := repo.Open(filepath.Join(t.TempDir(), "panel.db"))
+	repo, err := sqlite.Open(filepath.Join(t.TempDir(), "panel.db"))
 	if err != nil {
 		t.Fatalf("open repo: %v", err)
 	}
-	defer r.Close()
+	defer repo.Close()

-	h := &Handler{repo: r}
+	h := &Handler{repo: repo}
 	now := time.Now().UnixMilli()

 	insertNode := func(name string, status int, portRange string, isRemote int) int64 {
-		if execErr := r.DB().Exec(`
+		res, execErr := repo.DB().Exec(`
 			INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx, is_remote, remote_url, remote_token, remote_config)
 			VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-		`, name, name+"-secret", "10.0.0.1", "10.0.0.1", "", portRange, "", "v1", 1, 1, 1, now, now, status, "[::]", "[::]", 0, isRemote, "http://peer", "peer-token", `{"shareId":2}`).Error; execErr != nil {
+		`, name, name+"-secret", "10.0.0.1", "10.0.0.1", "", portRange, "", "v1", 1, 1, 1, now, now, status, "[::]", "[::]", 0, isRemote, "http://peer", "peer-token", `{"shareId":2}`)
+		if execErr != nil {
 			t.Fatalf("insert node %s: %v", name, execErr)
 		}
-		return mustLastInsertID(t, r, name)
+		id, idErr := res.LastInsertId()
+		if idErr != nil {
+			t.Fatalf("node id %s: %v", name, idErr)
+		}
+		return id
 	}

 	entryID := insertNode("entry-local", 1, "32000-32010", 0)
 	remoteMiddleID := insertNode("middle-remote", 0, "33000-33010", 1)
 	outID := insertNode("out-local", 1, "34000-34010", 0)

-	tx := r.DB().Begin()
-	if tx.Error != nil {
+	tx, err := repo.DB().Begin()
+	if err != nil {
 		t.Fatalf("begin tx: %v", err)
 	}
 	defer tx.Rollback()
@@ -228,16 +238,16 @@ func TestPrepareTunnelCreateStateAllowsOfflineRemoteMiddleNode(t *testing.T) {
 }

 func TestFederationRuntimeReservePortRejectsWhenShareFlowExceeded(t *testing.T) {
-	r, err := repo.Open(filepath.Join(t.TempDir(), "panel.db"))
+	repo, err := sqlite.Open(filepath.Join(t.TempDir(), "panel.db"))
 	if err != nil {
 		t.Fatalf("open repo: %v", err)
 	}
-	defer r.Close()
+	defer repo.Close()

-	h := &Handler{repo: r}
+	h := &Handler{repo: repo}
 	now := time.Now().UnixMilli()

-	if err := r.CreatePeerShare(&repo.PeerShare{
+	if err := repo.CreatePeerShare(&sqlite.PeerShare{
 		Name:           "limited-share",
 		NodeID:         1,
 		Token:          "limited-token",
@@ -12,26 +12,30 @@ import (
 	"time"

 	"go-backend/internal/http/response"
-	"go-backend/internal/store/repo"
+	"go-backend/internal/store/sqlite"
 )

 func TestFederationShareCreateRejectsRemoteNode(t *testing.T) {
-	r, err := repo.Open(filepath.Join(t.TempDir(), "panel.db"))
+	repo, err := sqlite.Open(filepath.Join(t.TempDir(), "panel.db"))
 	if err != nil {
 		t.Fatalf("open sqlite: %v", err)
 	}
-	t.Cleanup(func() { _ = r.Close() })
+	t.Cleanup(func() { _ = repo.Close() })

-	h := New(r, "test-jwt-secret")
+	h := New(repo, "test-jwt-secret")
 	now := time.Now().UnixMilli()

-	if err := r.DB().Exec(`
+	insertRes, err := repo.DB().Exec(`
 		INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx, is_remote, remote_url, remote_token, remote_config)
 		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, "remote-share-node", "remote-share-secret", "10.10.10.1", "10.10.10.1", "", "20000-20010", "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", 0, 1, "http://peer.example", "peer-token", `{"shareId":1}`).Error; err != nil {
+	`, "remote-share-node", "remote-share-secret", "10.10.10.1", "10.10.10.1", "", "20000-20010", "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", 0, 1, "http://peer.example", "peer-token", `{"shareId":1}`)
+	if err != nil {
 		t.Fatalf("insert remote node: %v", err)
 	}
-	remoteNodeID := mustLastInsertID(t, r, "remote-share-node")
+	remoteNodeID, err := insertRes.LastInsertId()
+	if err != nil {
+		t.Fatalf("get remote node id: %v", err)
+	}

 	body, err := json.Marshal(createPeerShareRequest{
 		Name:           "remote-node-share",
@@ -66,29 +70,36 @@ func TestFederationShareCreateRejectsRemoteNode(t *testing.T) {
 		t.Fatalf("expected rejection message %q, got %q", "Only local nodes can be shared", payload.Msg)
 	}

-	shareCount := mustQueryInt(t, r, `SELECT COUNT(1) FROM peer_share WHERE node_id = ?`, remoteNodeID)
+	var shareCount int
+	if err := repo.DB().QueryRow(`SELECT COUNT(1) FROM peer_share WHERE node_id = ?`, remoteNodeID).Scan(&shareCount); err != nil {
+		t.Fatalf("query peer_share count: %v", err)
+	}
 	if shareCount != 0 {
 		t.Fatalf("expected no share rows for remote node, got %d", shareCount)
 	}
 }

 func TestFederationShareCreateRejectsInvalidAllowedIPs(t *testing.T) {
-	r, err := repo.Open(filepath.Join(t.TempDir(), "panel.db"))
+	repo, err := sqlite.Open(filepath.Join(t.TempDir(), "panel.db"))
 	if err != nil {
 		t.Fatalf("open sqlite: %v", err)
 	}
-	t.Cleanup(func() { _ = r.Close() })
+	t.Cleanup(func() { _ = repo.Close() })

-	h := New(r, "test-jwt-secret")
+	h := New(repo, "test-jwt-secret")
 	now := time.Now().UnixMilli()

-	if err := r.DB().Exec(`
+	insertRes, err := repo.DB().Exec(`
 		INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx, is_remote, remote_url, remote_token, remote_config)
 		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, "local-share-node", "local-share-secret", "10.20.30.40", "10.20.30.40", "", "21000-21010", "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", 0, 0, "", "", "").Error; err != nil {
+	`, "local-share-node", "local-share-secret", "10.20.30.40", "10.20.30.40", "", "21000-21010", "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", 0, 0, "", "", "")
+	if err != nil {
 		t.Fatalf("insert local node: %v", err)
 	}
-	localNodeID := mustLastInsertID(t, r, "local-share-node")
+	localNodeID, err := insertRes.LastInsertId()
+	if err != nil {
+		t.Fatalf("get local node id: %v", err)
+	}

 	body, err := json.Marshal(createPeerShareRequest{
 		Name:           "local-node-share",
@@ -124,23 +135,26 @@ func TestFederationShareCreateRejectsInvalidAllowedIPs(t *testing.T) {
 		t.Fatalf("expected invalid IP message, got %q", payload.Msg)
 	}

-	shareCount := mustQueryInt(t, r, `SELECT COUNT(1) FROM peer_share WHERE node_id = ?`, localNodeID)
+	var shareCount int
+	if err := repo.DB().QueryRow(`SELECT COUNT(1) FROM peer_share WHERE node_id = ?`, localNodeID).Scan(&shareCount); err != nil {
+		t.Fatalf("query peer_share count: %v", err)
+	}
 	if shareCount != 0 {
 		t.Fatalf("expected no share rows for node, got %d", shareCount)
 	}
 }

 func TestFederationShareListIncludesRemoteUsedPorts(t *testing.T) {
-	r, err := repo.Open(filepath.Join(t.TempDir(), "panel.db"))
+	repo, err := sqlite.Open(filepath.Join(t.TempDir(), "panel.db"))
 	if err != nil {
 		t.Fatalf("open sqlite: %v", err)
 	}
-	t.Cleanup(func() { _ = r.Close() })
+	t.Cleanup(func() { _ = repo.Close() })

-	h := New(r, "test-jwt-secret")
+	h := New(repo, "test-jwt-secret")
 	now := time.Now().UnixMilli()

-	if err := r.CreatePeerShare(&repo.PeerShare{
+	if err := repo.CreatePeerShare(&sqlite.PeerShare{
 		Name:           "provider-share",
 		NodeID:         9,
 		Token:          "share-list-token",
@@ -155,12 +169,12 @@ func TestFederationShareListIncludesRemoteUsedPorts(t *testing.T) {
 		t.Fatalf("create peer share: %v", err)
 	}

-	share, err := r.GetPeerShareByToken("share-list-token")
+	share, err := repo.GetPeerShareByToken("share-list-token")
 	if err != nil || share == nil {
 		t.Fatalf("load peer share: %v", err)
 	}

-	if err := r.DB().Exec(`
+	if _, err := repo.DB().Exec(`
 		INSERT INTO peer_share_runtime(share_id, node_id, reservation_id, resource_key, binding_id, role, chain_name, service_name, protocol, strategy, port, target, applied, status, created_time, updated_time)
 		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?),
 		      (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?),
@@ -169,7 +183,7 @@ func TestFederationShareListIncludesRemoteUsedPorts(t *testing.T) {
 		share.ID, share.NodeID, "r-1", "rk-1", "b-1", "middle", "fed_chain_1", "fed_svc_1", "tls", "round", 22001, "", 1, 1, now, now,
 		share.ID, share.NodeID, "r-2", "rk-2", "b-2", "exit", "", "fed_svc_2", "tls", "round", 22002, "", 1, 1, now, now,
 		share.ID, share.NodeID, "r-3", "rk-3", "", "", "", "", "tls", "round", 22003, "", 0, 0, now, now,
-	).Error; err != nil {
+	); err != nil {
 		t.Fatalf("insert peer_share_runtime rows: %v", err)
 	}

@@ -224,16 +238,16 @@ func TestFederationShareListIncludesRemoteUsedPorts(t *testing.T) {
 }

 func TestFederationShareDeleteCleansUpRuntimes(t *testing.T) {
-	r, err := repo.Open(filepath.Join(t.TempDir(), "panel.db"))
+	repo, err := sqlite.Open(filepath.Join(t.TempDir(), "panel.db"))
 	if err != nil {
 		t.Fatalf("open sqlite: %v", err)
 	}
-	t.Cleanup(func() { _ = r.Close() })
+	t.Cleanup(func() { _ = repo.Close() })

-	h := New(r, "test-jwt-secret")
+	h := New(repo, "test-jwt-secret")
 	now := time.Now().UnixMilli()

-	if err := r.CreatePeerShare(&repo.PeerShare{
+	if err := repo.CreatePeerShare(&sqlite.PeerShare{
 		Name:           "delete-cleanup-share",
 		NodeID:         99,
 		Token:          "delete-cleanup-token",
@@ -247,23 +261,26 @@ func TestFederationShareDeleteCleansUpRuntimes(t *testing.T) {
 		t.Fatalf("create peer share: %v", err)
 	}

-	share, err := r.GetPeerShareByToken("delete-cleanup-token")
+	share, err := repo.GetPeerShareByToken("delete-cleanup-token")
 	if err != nil || share == nil {
 		t.Fatalf("load peer share: %v", err)
 	}

-	if err := r.DB().Exec(`
+	if _, err := repo.DB().Exec(`
 		INSERT INTO peer_share_runtime(share_id, node_id, reservation_id, resource_key, binding_id, role, chain_name, service_name, protocol, strategy, port, target, applied, status, created_time, updated_time)
 		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?),
 		      (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
 	`,
 		share.ID, 99, "dc-r1", "dc-rk1", "dc-b1", "exit", "", "fed_svc_dc1", "tls", "round", 40001, "", 1, 1, now, now,
 		share.ID, 99, "dc-r2", "dc-rk2", "dc-b2", "middle", "fed_chain_dc2", "fed_svc_dc2", "tls", "round", 40002, "", 1, 1, now, now,
-	).Error; err != nil {
+	); err != nil {
 		t.Fatalf("insert peer_share_runtime rows: %v", err)
 	}

-	runtimeCount := mustQueryInt(t, r, `SELECT COUNT(1) FROM peer_share_runtime WHERE share_id = ? AND status = 1`, share.ID)
+	var runtimeCount int
+	if err := repo.DB().QueryRow(`SELECT COUNT(1) FROM peer_share_runtime WHERE share_id = ? AND status = 1`, share.ID).Scan(&runtimeCount); err != nil {
+		t.Fatalf("count active runtimes before: %v", err)
+	}
 	if runtimeCount != 2 {
 		t.Fatalf("expected 2 active runtimes before delete, got %d", runtimeCount)
 	}
@@ -289,31 +306,37 @@ func TestFederationShareDeleteCleansUpRuntimes(t *testing.T) {
 		t.Fatalf("expected response code 0, got %d (%s)", payload.Code, payload.Msg)
 	}

-	shareCount := mustQueryInt(t, r, `SELECT COUNT(1) FROM peer_share WHERE id = ?`, share.ID)
+	var shareCount int
+	if err := repo.DB().QueryRow(`SELECT COUNT(1) FROM peer_share WHERE id = ?`, share.ID).Scan(&shareCount); err != nil {
+		t.Fatalf("count peer_share after: %v", err)
+	}
 	if shareCount != 0 {
 		t.Fatalf("expected peer_share deleted, got %d rows", shareCount)
 	}

-	runtimeCountAfter := mustQueryInt(t, r, `SELECT COUNT(1) FROM peer_share_runtime WHERE share_id = ?`, share.ID)
+	var runtimeCountAfter int
+	if err := repo.DB().QueryRow(`SELECT COUNT(1) FROM peer_share_runtime WHERE share_id = ?`, share.ID).Scan(&runtimeCountAfter); err != nil {
+		t.Fatalf("count peer_share_runtime after: %v", err)
+	}
 	if runtimeCountAfter != 0 {
 		t.Fatalf("expected all peer_share_runtime rows deleted, got %d", runtimeCountAfter)
 	}
 }

 func TestFederationRemoteUsageListSyncErrorFallback(t *testing.T) {
-	r, err := repo.Open(filepath.Join(t.TempDir(), "panel.db"))
+	repo, err := sqlite.Open(filepath.Join(t.TempDir(), "panel.db"))
 	if err != nil {
 		t.Fatalf("open sqlite: %v", err)
 	}
-	t.Cleanup(func() { _ = r.Close() })
+	t.Cleanup(func() { _ = repo.Close() })

-	h := New(r, "test-jwt-secret")
+	h := New(repo, "test-jwt-secret")
 	now := time.Now().UnixMilli()

-	if err := r.DB().Exec(`
+	if _, err := repo.DB().Exec(`
 		INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx, is_remote, remote_url, remote_token, remote_config)
 		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, "sync-error-node", "sync-error-secret", "10.50.60.70", "10.50.60.70", "", "32000-32010", "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", 0, 1, "http://unreachable.invalid:9999", "bad-token", `{"shareId":42,"maxBandwidth":5368709120,"currentFlow":999999,"portRangeStart":32000,"portRangeEnd":32010}`).Error; err != nil {
+	`, "sync-error-node", "sync-error-secret", "10.50.60.70", "10.50.60.70", "", "32000-32010", "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", 0, 1, "http://unreachable.invalid:9999", "bad-token", `{"shareId":42,"maxBandwidth":5368709120,"currentFlow":999999,"portRangeStart":32000,"portRangeEnd":32010}`); err != nil {
 		t.Fatalf("insert remote node: %v", err)
 	}

@@ -357,15 +380,15 @@ func TestFederationRemoteUsageListSyncErrorFallback(t *testing.T) {
 }

 func TestFederationShareResetFlow(t *testing.T) {
-	r, err := repo.Open(filepath.Join(t.TempDir(), "panel.db"))
+	repo, err := sqlite.Open(filepath.Join(t.TempDir(), "panel.db"))
 	if err != nil {
 		t.Fatalf("open sqlite: %v", err)
 	}
-	t.Cleanup(func() { _ = r.Close() })
+	t.Cleanup(func() { _ = repo.Close() })

-	h := New(r, "test-jwt-secret")
+	h := New(repo, "test-jwt-secret")
 	now := time.Now().UnixMilli()
-	if err := r.CreatePeerShare(&repo.PeerShare{
+	if err := repo.CreatePeerShare(&sqlite.PeerShare{
 		Name:           "reset-flow-share",
 		NodeID:         11,
 		Token:          "reset-flow-token",
@@ -379,7 +402,7 @@ func TestFederationShareResetFlow(t *testing.T) {
 	}); err != nil {
 		t.Fatalf("create peer share: %v", err)
 	}
-	share, err := r.GetPeerShareByToken("reset-flow-token")
+	share, err := repo.GetPeerShareByToken("reset-flow-token")
 	if err != nil || share == nil {
 		t.Fatalf("load peer share: %v", err)
 	}
@@ -405,7 +428,7 @@ func TestFederationShareResetFlow(t *testing.T) {
 		t.Fatalf("expected response code 0, got %d (%s)", payload.Code, payload.Msg)
 	}

-	updated, err := r.GetPeerShare(share.ID)
+	updated, err := repo.GetPeerShare(share.ID)
 	if err != nil || updated == nil {
 		t.Fatalf("reload peer share: %v", err)
 	}
@@ -414,481 +437,48 @@ func TestFederationShareResetFlow(t *testing.T) {
 	}
 }

-func TestFederationTunnelCreateCreatesPeerShareRuntime(t *testing.T) {
-	r, err := repo.Open(filepath.Join(t.TempDir(), "panel.db"))
-	if err != nil {
-		t.Fatalf("open sqlite: %v", err)
-	}
-	t.Cleanup(func() { _ = r.Close() })
-
-	h := New(r, "test-jwt-secret")
-	now := time.Now().UnixMilli()
-
-	if err := r.DB().Exec(`
-		INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx, is_remote, remote_url, remote_token, remote_config)
-		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, "federation-forward-node", "federation-forward-secret", "10.90.80.70", "10.90.80.70", "", "24000-24020", "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", 0, 0, "", "", "").Error; err != nil {
-		t.Fatalf("insert node: %v", err)
-	}
-	nodeID := mustLastInsertID(t, r, "federation-forward-node")
-
-	if err := r.CreatePeerShare(&repo.PeerShare{
-		Name:           "federation-forward-share",
-		NodeID:         nodeID,
-		Token:          "federation-forward-token",
-		MaxBandwidth:   0,
-		CurrentFlow:    0,
-		PortRangeStart: 24000,
-		PortRangeEnd:   24020,
-		IsActive:       1,
-		CreatedTime:    now,
-		UpdatedTime:    now,
-	}); err != nil {
-		t.Fatalf("create share: %v", err)
-	}
-	share, err := r.GetPeerShareByToken("federation-forward-token")
-	if err != nil || share == nil {
-		t.Fatalf("load share: %v", err)
-	}
-
-	body, err := json.Marshal(federationTunnelRequest{
-		Protocol:   "tcp",
-		RemotePort: 24001,
-		Target:     "1.1.1.1:443",
-	})
-	if err != nil {
-		t.Fatalf("marshal request: %v", err)
-	}
-
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/federation/tunnel/create", bytes.NewReader(body))
-	req.Header.Set("Authorization", "Bearer "+share.Token)
-	req.Header.Set("Content-Type", "application/json")
-	res := httptest.NewRecorder()
-
-	h.federationTunnelCreate(res, req)
-
-	if res.Code != http.StatusOK {
-		t.Fatalf("expected status %d, got %d", http.StatusOK, res.Code)
-	}
-
-	var payload response.R
-	if err := json.NewDecoder(res.Body).Decode(&payload); err != nil {
-		t.Fatalf("decode response: %v", err)
-	}
-	if payload.Code != 0 {
-		t.Fatalf("expected response code 0, got %d (%s)", payload.Code, payload.Msg)
-	}
-
-	runtimeCount := mustQueryInt(t, r, `SELECT COUNT(1) FROM peer_share_runtime WHERE share_id = ? AND port = ? AND status = 1`, share.ID, 24001)
-	if runtimeCount != 1 {
-		t.Fatalf("expected 1 runtime row for new federation forward tunnel, got %d", runtimeCount)
-	}
-}
-
-func TestFederationTunnelCreateRejectsOccupiedPort(t *testing.T) {
-	r, err := repo.Open(filepath.Join(t.TempDir(), "panel.db"))
-	if err != nil {
-		t.Fatalf("open sqlite: %v", err)
-	}
-	t.Cleanup(func() { _ = r.Close() })
-
-	h := New(r, "test-jwt-secret")
-	now := time.Now().UnixMilli()
-
-	if err := r.DB().Exec(`
-		INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx, is_remote, remote_url, remote_token, remote_config)
-		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, "federation-port-check-node", "federation-port-check-secret", "10.91.80.70", "10.91.80.70", "", "24100-24120", "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", 0, 0, "", "", "").Error; err != nil {
-		t.Fatalf("insert node: %v", err)
-	}
-	nodeID := mustLastInsertID(t, r, "federation-port-check-node")
-
-	if err := r.CreatePeerShare(&repo.PeerShare{
-		Name:           "federation-port-check-share",
-		NodeID:         nodeID,
-		Token:          "federation-port-check-token",
-		MaxBandwidth:   0,
-		CurrentFlow:    0,
-		PortRangeStart: 24100,
-		PortRangeEnd:   24120,
-		IsActive:       1,
-		CreatedTime:    now,
-		UpdatedTime:    now,
-	}); err != nil {
-		t.Fatalf("create share: %v", err)
-	}
-
-	create := func() response.R {
-		body, err := json.Marshal(federationTunnelRequest{Protocol: "tcp", RemotePort: 24101, Target: "1.1.1.1:443"})
-		if err != nil {
-			t.Fatalf("marshal request: %v", err)
-		}
-		req := httptest.NewRequest(http.MethodPost, "/api/v1/federation/tunnel/create", bytes.NewReader(body))
-		req.Header.Set("Authorization", "Bearer federation-port-check-token")
-		req.Header.Set("Content-Type", "application/json")
-		res := httptest.NewRecorder()
-		h.federationTunnelCreate(res, req)
-		if res.Code != http.StatusOK {
-			t.Fatalf("expected status %d, got %d", http.StatusOK, res.Code)
-		}
-		var payload response.R
-		if err := json.NewDecoder(res.Body).Decode(&payload); err != nil {
-			t.Fatalf("decode response: %v", err)
-		}
-		return payload
-	}
-
-	first := create()
-	if first.Code != 0 {
-		t.Fatalf("expected first create success, got %d (%s)", first.Code, first.Msg)
-	}
-
-	second := create()
-	if second.Code != 403 {
-		t.Fatalf("expected second create to be rejected with 403, got %d (%s)", second.Code, second.Msg)
-	}
-	if second.Msg != "Port already in use" {
-		t.Fatalf("expected occupied port message, got %q", second.Msg)
-	}
-}
-
-func TestDeleteTunnelReleasesFederationForwardRuntimeByPort(t *testing.T) {
-	r, err := repo.Open(filepath.Join(t.TempDir(), "panel.db"))
-	if err != nil {
-		t.Fatalf("open sqlite: %v", err)
-	}
-	t.Cleanup(func() { _ = r.Close() })
-
-	h := New(r, "test-jwt-secret")
-	now := time.Now().UnixMilli()
-
-	if err := r.CreatePeerShare(&repo.PeerShare{
-		Name:           "delete-forward-share",
-		NodeID:         1,
-		Token:          "delete-forward-token",
-		MaxBandwidth:   0,
-		CurrentFlow:    0,
-		PortRangeStart: 25000,
-		PortRangeEnd:   25020,
-		IsActive:       1,
-		CreatedTime:    now,
-		UpdatedTime:    now,
-	}); err != nil {
-		t.Fatalf("create share: %v", err)
-	}
-	share, err := r.GetPeerShareByToken("delete-forward-token")
-	if err != nil || share == nil {
-		t.Fatalf("load share: %v", err)
-	}
-
-	tunnelName := fmt.Sprintf("Share-%d-Port-%d", share.ID, 25001)
-	if err := r.DB().Exec(`
-		INSERT INTO tunnel(id, name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
-		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, 1, tunnelName, 1.0, 1, "tcp", 1, now, now, 1, nil, 0).Error; err != nil {
-		t.Fatalf("insert tunnel: %v", err)
-	}
-
-	if err := r.DB().Exec(`
-		INSERT INTO peer_share_runtime(share_id, node_id, reservation_id, resource_key, binding_id, role, chain_name, service_name, protocol, strategy, port, target, applied, status, created_time, updated_time)
-		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, share.ID, share.NodeID, "del-r1", "del-rk1", "", "forward", "", "20_2_10", "tcp", "fifo", 25001, "", 1, 1, now, now).Error; err != nil {
-		t.Fatalf("insert runtime: %v", err)
-	}
-
-	if err := h.deleteTunnelByID(1); err != nil {
-		t.Fatalf("delete tunnel: %v", err)
-	}
-
-	activeCount := mustQueryInt(t, r, `SELECT COUNT(1) FROM peer_share_runtime WHERE share_id = ? AND port = ? AND status = 1`, share.ID, 25001)
-	if activeCount != 0 {
-		t.Fatalf("expected runtime released after tunnel delete, active rows=%d", activeCount)
-	}
-}
-
-func TestBindPeerShareForwardRuntimeServicesOnlyBindsForwardRole(t *testing.T) {
-	r, err := repo.Open(filepath.Join(t.TempDir(), "panel.db"))
-	if err != nil {
-		t.Fatalf("open sqlite: %v", err)
-	}
-	t.Cleanup(func() { _ = r.Close() })
-
-	h := New(r, "test-jwt-secret")
-	now := time.Now().UnixMilli()
-
-	if err := r.CreatePeerShare(&repo.PeerShare{
-		Name:           "bind-forward-role-share",
-		NodeID:         1,
-		Token:          "bind-forward-role-token",
-		MaxBandwidth:   0,
-		CurrentFlow:    0,
-		PortRangeStart: 26000,
-		PortRangeEnd:   26020,
-		IsActive:       1,
-		CreatedTime:    now,
-		UpdatedTime:    now,
-	}); err != nil {
-		t.Fatalf("create share: %v", err)
-	}
-	share, err := r.GetPeerShareByToken("bind-forward-role-token")
-	if err != nil || share == nil {
-		t.Fatalf("load share: %v", err)
-	}
-
-	if err := r.DB().Exec(`
-		INSERT INTO peer_share_runtime(id, share_id, node_id, reservation_id, resource_key, binding_id, role, chain_name, service_name, protocol, strategy, port, target, applied, status, created_time, updated_time)
-		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?),
-		      (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`,
-		1, share.ID, share.NodeID, "bind-r1", "bind-rk1", "", "forward", "", "", "tcp", "fifo", 26001, "", 0, 1, now, now,
-		2, share.ID, share.NodeID, "bind-r2", "bind-rk2", "", "middle", "", "", "tcp", "round", 26002, "", 0, 1, now, now,
-	).Error; err != nil {
-		t.Fatalf("insert runtimes: %v", err)
-	}
-
-	h.bindPeerShareForwardRuntimeServices(share, map[string]interface{}{
-		"services": []interface{}{
-			map[string]interface{}{"name": "77_2_10_tcp", "addr": "[::]:26001"},
-			map[string]interface{}{"name": "88_2_10_tcp", "addr": "[::]:26002"},
-		},
-	})
-
-	forwardServiceName := ""
-	middleServiceName := ""
-	if err := r.DB().Raw(`SELECT service_name FROM peer_share_runtime WHERE id = 1`).Scan(&forwardServiceName).Error; err != nil {
-		t.Fatalf("load forward runtime service name: %v", err)
-	}
-	if err := r.DB().Raw(`SELECT service_name FROM peer_share_runtime WHERE id = 2`).Scan(&middleServiceName).Error; err != nil {
-		t.Fatalf("load middle runtime service name: %v", err)
-	}
-
-	if forwardServiceName != "77_2_10" {
-		t.Fatalf("expected forward runtime service name bound, got %q", forwardServiceName)
-	}
-	if middleServiceName != "" {
-		t.Fatalf("expected non-forward runtime unchanged, got %q", middleServiceName)
-	}
-}
-
-func TestBindPeerShareForwardRuntimeServicesAcceptsTopLevelServiceArray(t *testing.T) {
-	r, err := repo.Open(filepath.Join(t.TempDir(), "panel.db"))
-	if err != nil {
-		t.Fatalf("open sqlite: %v", err)
-	}
-	t.Cleanup(func() { _ = r.Close() })
-
-	h := New(r, "test-jwt-secret")
-	now := time.Now().UnixMilli()
-
-	if err := r.CreatePeerShare(&repo.PeerShare{
-		Name:           "bind-array-share",
-		NodeID:         1,
-		Token:          "bind-array-token",
-		MaxBandwidth:   0,
-		CurrentFlow:    0,
-		PortRangeStart: 26100,
-		PortRangeEnd:   26120,
-		IsActive:       1,
-		CreatedTime:    now,
-		UpdatedTime:    now,
-	}); err != nil {
-		t.Fatalf("create share: %v", err)
-	}
-	share, err := r.GetPeerShareByToken("bind-array-token")
-	if err != nil || share == nil {
-		t.Fatalf("load share: %v", err)
-	}
-
-	if err := r.DB().Exec(`
-		INSERT INTO peer_share_runtime(id, share_id, node_id, reservation_id, resource_key, binding_id, role, chain_name, service_name, protocol, strategy, port, target, applied, status, created_time, updated_time)
-		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`,
-		1, share.ID, share.NodeID, "bind-array-r1", "bind-array-rk1", "", "forward", "", "", "tcp", "fifo", 26101, "", 0, 1, now, now,
-	).Error; err != nil {
-		t.Fatalf("insert runtime: %v", err)
-	}
-
-	h.bindPeerShareForwardRuntimeServices(share, []interface{}{
-		map[string]interface{}{"name": "99_2_10_tcp", "addr": "[::]:26101"},
-		map[string]interface{}{"name": "99_2_10_udp", "addr": "[::]:26101"},
-	})
-
-	forwardServiceName := ""
-	if err := r.DB().Raw(`SELECT service_name FROM peer_share_runtime WHERE id = 1`).Scan(&forwardServiceName).Error; err != nil {
-		t.Fatalf("load forward runtime service name: %v", err)
-	}
-	if forwardServiceName != "99_2_10" {
-		t.Fatalf("expected forward runtime service name bound from top-level array, got %q", forwardServiceName)
-	}
-}
-
-func TestBindPeerShareForwardRuntimeServicesCreatesRuntimeWhenMissing(t *testing.T) {
-	r, err := repo.Open(filepath.Join(t.TempDir(), "panel-bind-create-runtime.db"))
-	if err != nil {
-		t.Fatalf("open sqlite: %v", err)
-	}
-	t.Cleanup(func() { _ = r.Close() })
-
-	h := New(r, "test-jwt-secret")
-	now := time.Now().UnixMilli()
-
-	if err := r.CreatePeerShare(&repo.PeerShare{
-		Name:           "bind-create-runtime-share",
-		NodeID:         1,
-		Token:          "bind-create-runtime-token",
-		MaxBandwidth:   0,
-		CurrentFlow:    0,
-		PortRangeStart: 26300,
-		PortRangeEnd:   26320,
-		IsActive:       1,
-		CreatedTime:    now,
-		UpdatedTime:    now,
-	}); err != nil {
-		t.Fatalf("create share: %v", err)
-	}
-	share, err := r.GetPeerShareByToken("bind-create-runtime-token")
-	if err != nil || share == nil {
-		t.Fatalf("load share: %v", err)
-	}
-
-	h.bindPeerShareForwardRuntimeServices(share, map[string]interface{}{
-		"services": []interface{}{
-			map[string]interface{}{"name": "55_2_10_tcp", "addr": "[::]:26301"},
-		},
-	})
-
-	var count int64
-	if err := r.DB().Raw(`SELECT COUNT(1) FROM peer_share_runtime WHERE share_id = ? AND role = ? AND status = 1`, share.ID, "forward").Scan(&count).Error; err != nil {
-		t.Fatalf("query runtime count: %v", err)
-	}
-	if count != 1 {
-		t.Fatalf("expected 1 active forward runtime row, got %d", count)
-	}
-
-	var serviceName string
-	var port int
-	var applied int
-	if err := r.DB().Raw(`SELECT service_name, port, applied FROM peer_share_runtime WHERE share_id = ? AND role = ? ORDER BY id DESC LIMIT 1`, share.ID, "forward").Row().Scan(&serviceName, &port, &applied); err != nil {
-		t.Fatalf("query created runtime: %v", err)
-	}
-	if serviceName != "55_2_10" {
-		t.Fatalf("expected service_name=55_2_10, got %q", serviceName)
-	}
-	if port != 26301 {
-		t.Fatalf("expected port=26301, got %d", port)
-	}
-	if applied != 1 {
-		t.Fatalf("expected applied=1, got %d", applied)
-	}
-}
-
-func TestReleasePeerShareForwardRuntimeServicesMarksRuntimeReleased(t *testing.T) {
-	r, err := repo.Open(filepath.Join(t.TempDir(), "panel-release-runtime.db"))
-	if err != nil {
-		t.Fatalf("open sqlite: %v", err)
-	}
-	t.Cleanup(func() { _ = r.Close() })
-
-	h := New(r, "test-jwt-secret")
-	now := time.Now().UnixMilli()
-
-	if err := r.CreatePeerShare(&repo.PeerShare{
-		Name:           "release-runtime-share",
-		NodeID:         1,
-		Token:          "release-runtime-token",
-		MaxBandwidth:   0,
-		CurrentFlow:    0,
-		PortRangeStart: 26400,
-		PortRangeEnd:   26420,
-		IsActive:       1,
-		CreatedTime:    now,
-		UpdatedTime:    now,
-	}); err != nil {
-		t.Fatalf("create share: %v", err)
-	}
-	share, err := r.GetPeerShareByToken("release-runtime-token")
-	if err != nil || share == nil {
-		t.Fatalf("load share: %v", err)
-	}
-
-	if err := r.DB().Exec(`
-		INSERT INTO peer_share_runtime(share_id, node_id, reservation_id, resource_key, binding_id, role, chain_name, service_name, protocol, strategy, port, target, applied, status, created_time, updated_time)
-		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, share.ID, share.NodeID, "release-r1", "release-rk1", "", "forward", "", "77_2_10", "tcp", "fifo", 26401, "", 1, 1, now, now).Error; err != nil {
-		t.Fatalf("insert runtime: %v", err)
-	}
-
-	h.releasePeerShareForwardRuntimeServices(share, map[string]interface{}{
-		"services": []interface{}{"77_2_10_tcp"},
-	})
-
-	var status int
-	var applied int
-	var serviceName string
-	if err := r.DB().Raw(`SELECT status, applied, service_name FROM peer_share_runtime WHERE share_id = ? AND role = ? ORDER BY id DESC LIMIT 1`, share.ID, "forward").Row().Scan(&status, &applied, &serviceName); err != nil {
-		t.Fatalf("query released runtime: %v", err)
-	}
-	if status != 0 {
-		t.Fatalf("expected status=0 after release, got %d", status)
-	}
-	if applied != 0 {
-		t.Fatalf("expected applied=0 after release, got %d", applied)
-	}
-	if serviceName != "" {
-		t.Fatalf("expected service_name cleared after release, got %q", serviceName)
-	}
-}
-
-func TestValidateFederationCommandPortsAcceptsTopLevelServiceArray(t *testing.T) {
-	share := &repo.PeerShare{
-		PortRangeStart: 26200,
-		PortRangeEnd:   26210,
-	}
-	err := validateFederationCommandPorts(share, []interface{}{
-		map[string]interface{}{"name": "11_2_10_tcp", "addr": "[::]:26201"},
-		map[string]interface{}{"name": "11_2_10_udp", "addr": "[::]:26201"},
-	})
-	if err != nil {
-		t.Fatalf("expected top-level service array to pass port validation, got: %v", err)
-	}
-}
-
 func TestFederationRemoteUsageList(t *testing.T) {
-	r, err := repo.Open(filepath.Join(t.TempDir(), "panel.db"))
+	repo, err := sqlite.Open(filepath.Join(t.TempDir(), "panel.db"))
 	if err != nil {
 		t.Fatalf("open sqlite: %v", err)
 	}
-	t.Cleanup(func() { _ = r.Close() })
+	t.Cleanup(func() { _ = repo.Close() })

-	h := New(r, "test-jwt-secret")
+	h := New(repo, "test-jwt-secret")
 	now := time.Now().UnixMilli()

-	if err := r.DB().Exec(`
+	resNode, err := repo.DB().Exec(`
 		INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx, is_remote, remote_url, remote_token, remote_config)
 		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, "remote-consumer-node", "remote-consumer-secret", "10.30.40.50", "10.30.40.50", "", "31000-31010", "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", 0, 1, "http://peer.example", "peer-token", `{"shareId":88,"maxBandwidth":2147483648,"currentFlow":1073741824,"portRangeStart":31000,"portRangeEnd":31010}`).Error; err != nil {
+	`, "remote-consumer-node", "remote-consumer-secret", "10.30.40.50", "10.30.40.50", "", "31000-31010", "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", 0, 1, "http://peer.example", "peer-token", `{"shareId":88,"maxBandwidth":2147483648,"currentFlow":1073741824,"portRangeStart":31000,"portRangeEnd":31010}`)
+	if err != nil {
 		t.Fatalf("insert remote node: %v", err)
 	}
-	nodeID := mustLastInsertID(t, r, "remote-consumer-node")
+	nodeID, err := resNode.LastInsertId()
+	if err != nil {
+		t.Fatalf("remote node id: %v", err)
+	}

-	if err := r.DB().Exec(`INSERT INTO tunnel(name, type, protocol, flow, created_time, updated_time, status, in_ip, inx) VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?)`, "consumer-tunnel-a", 2, "tls", 1, now, now, 1, "", 0).Error; err != nil {
+	resTunnelA, err := repo.DB().Exec(`INSERT INTO tunnel(name, type, protocol, flow, created_time, updated_time, status, in_ip, inx) VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?)`, "consumer-tunnel-a", 2, "tls", 1, now, now, 1, "", 0)
+	if err != nil {
 		t.Fatalf("insert tunnel a: %v", err)
 	}
-	tunnelAID := mustLastInsertID(t, r, "consumer-tunnel-a")
+	tunnelAID, _ := resTunnelA.LastInsertId()

-	if err := r.DB().Exec(`INSERT INTO tunnel(name, type, protocol, flow, created_time, updated_time, status, in_ip, inx) VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?)`, "consumer-tunnel-b", 2, "tls", 1, now, now, 1, "", 0).Error; err != nil {
+	resTunnelB, err := repo.DB().Exec(`INSERT INTO tunnel(name, type, protocol, flow, created_time, updated_time, status, in_ip, inx) VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?)`, "consumer-tunnel-b", 2, "tls", 1, now, now, 1, "", 0)
+	if err != nil {
 		t.Fatalf("insert tunnel b: %v", err)
 	}
-	tunnelBID := mustLastInsertID(t, r, "consumer-tunnel-b")
+	tunnelBID, _ := resTunnelB.LastInsertId()

-	if err := r.DB().Exec(`
+	if _, err := repo.DB().Exec(`
 		INSERT INTO federation_tunnel_binding(tunnel_id, node_id, chain_type, hop_inx, remote_url, resource_key, remote_binding_id, allocated_port, status, created_time, updated_time)
 		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?),
 		      (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
 	`,
 		tunnelAID, nodeID, 2, 1, "http://peer.example", "rk-a", "rb-a", 31001, 1, now, now,
 		tunnelBID, nodeID, 3, 0, "http://peer.example", "rk-b", "rb-b", 31002, 1, now, now,
-	).Error; err != nil {
+	); err != nil {
 		t.Fatalf("insert federation bindings: %v", err)
 	}

@@ -941,118 +531,14 @@ func TestFederationRemoteUsageList(t *testing.T) {
 	}
 }

-func TestFederationRemoteUsageListIncludesForwardPorts(t *testing.T) {
-	r, err := repo.Open(filepath.Join(t.TempDir(), "panel-forward-usage.db"))
-	if err != nil {
-		t.Fatalf("open sqlite: %v", err)
-	}
-	t.Cleanup(func() { _ = r.Close() })
-
-	h := New(r, "test-jwt-secret")
-	now := time.Now().UnixMilli()
-
-	if err := r.DB().Exec(`
-		INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx, is_remote, remote_url, remote_token, remote_config)
-		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, "forward-usage-remote-node", "forward-usage-secret", "10.60.70.80", "10.60.70.80", "", "33000-33010", "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", 0, 1, "", "", `{"shareId":99,"maxBandwidth":0,"currentFlow":0,"portRangeStart":33000,"portRangeEnd":33010}`).Error; err != nil {
-		t.Fatalf("insert remote node: %v", err)
-	}
-
-	var nodeID int64
-	if err := r.DB().Raw(`SELECT id FROM node WHERE name = ? ORDER BY id DESC LIMIT 1`, "forward-usage-remote-node").Row().Scan(&nodeID); err != nil {
-		t.Fatalf("query node id: %v", err)
-	}
-
-	if err := r.DB().Exec(`
-		INSERT INTO tunnel(name, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
-		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, "forward-usage-tunnel", 1, "tls", 1, now, now, 1, "", 0).Error; err != nil {
-		t.Fatalf("insert tunnel: %v", err)
-	}
-
-	var tunnelID int64
-	if err := r.DB().Raw(`SELECT id FROM tunnel WHERE name = ? ORDER BY id DESC LIMIT 1`, "forward-usage-tunnel").Row().Scan(&tunnelID); err != nil {
-		t.Fatalf("query tunnel id: %v", err)
-	}
-
-	if err := r.DB().Exec(`
-		INSERT INTO forward(user_id, user_name, name, tunnel_id, remote_addr, strategy, in_flow, out_flow, created_time, updated_time, status, inx)
-		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, 1, "tester", "forward-usage-item", tunnelID, "1.1.1.1:443", "fifo", 0, 0, now, now, 1, 0).Error; err != nil {
-		t.Fatalf("insert forward: %v", err)
-	}
-
-	var forwardID int64
-	if err := r.DB().Raw(`SELECT id FROM forward WHERE name = ? ORDER BY id DESC LIMIT 1`, "forward-usage-item").Row().Scan(&forwardID); err != nil {
-		t.Fatalf("query forward id: %v", err)
-	}
-
-	if err := r.DB().Exec(`INSERT INTO forward_port(forward_id, node_id, port) VALUES(?, ?, ?)`, forwardID, nodeID, 33001).Error; err != nil {
-		t.Fatalf("insert forward_port: %v", err)
-	}
-
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/federation/share/remote-usage/list", nil)
-	res := httptest.NewRecorder()
-	h.federationRemoteUsageList(res, req)
-
-	if res.Code != http.StatusOK {
-		t.Fatalf("expected status %d, got %d", http.StatusOK, res.Code)
-	}
-
-	var payload response.R
-	if err := json.NewDecoder(res.Body).Decode(&payload); err != nil {
-		t.Fatalf("decode response: %v", err)
-	}
-	if payload.Code != 0 {
-		t.Fatalf("expected response code 0, got %d (%s)", payload.Code, payload.Msg)
-	}
-
-	rows, ok := payload.Data.([]interface{})
-	if !ok || len(rows) == 0 {
-		t.Fatalf("expected non-empty usage list, got %T", payload.Data)
-	}
-
-	first, ok := rows[0].(map[string]interface{})
-	if !ok {
-		t.Fatalf("expected usage row map, got %T", rows[0])
-	}
-
-	usedPortsRaw, ok := first["usedPorts"].([]interface{})
-	if !ok {
-		t.Fatalf("expected usedPorts array, got %T", first["usedPorts"])
-	}
-	if len(usedPortsRaw) != 1 || int(usedPortsRaw[0].(float64)) != 33001 {
-		t.Fatalf("expected usedPorts [33001], got %v", usedPortsRaw)
-	}
-
-	bindingsRaw, ok := first["bindings"].([]interface{})
-	if !ok {
-		t.Fatalf("expected bindings array, got %T", first["bindings"])
-	}
-	if len(bindingsRaw) != 1 {
-		t.Fatalf("expected 1 binding row from forward usage, got %d", len(bindingsRaw))
-	}
-
-	binding, ok := bindingsRaw[0].(map[string]interface{})
-	if !ok {
-		t.Fatalf("expected binding row object, got %T", bindingsRaw[0])
-	}
-	if int(binding["allocatedPort"].(float64)) != 33001 {
-		t.Fatalf("expected allocatedPort=33001, got %v", binding["allocatedPort"])
-	}
-	if int(binding["chainType"].(float64)) != 1 {
-		t.Fatalf("expected chainType=1 for forward usage row, got %v", binding["chainType"])
-	}
-}
-
 func TestAuthPeerAllowedIPs(t *testing.T) {
-	r, err := repo.Open(filepath.Join(t.TempDir(), "panel.db"))
+	repo, err := sqlite.Open(filepath.Join(t.TempDir(), "panel.db"))
 	if err != nil {
 		t.Fatalf("open sqlite: %v", err)
 	}
-	t.Cleanup(func() { _ = r.Close() })
+	t.Cleanup(func() { _ = repo.Close() })

-	h := New(r, "test-jwt-secret")
+	h := New(repo, "test-jwt-secret")
 	now := time.Now().UnixMilli()

 	tests := []struct {
@@ -1099,7 +585,7 @@ func TestAuthPeerAllowedIPs(t *testing.T) {
 	for idx, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			token := fmt.Sprintf("share-token-%d", idx)
-			if err := r.CreatePeerShare(&repo.PeerShare{
+			if err := repo.CreatePeerShare(&sqlite.PeerShare{
 				Name:           "share-" + tt.name,
 				NodeID:         1,
 				Token:          token,
@@ -1,13 +1,11 @@
 package handler

 import (
+	"database/sql"
 	"encoding/json"
-	"log"
 	"strconv"
 	"strings"
 	"time"
-
-	"go-backend/internal/store/model"
 )

 const bytesPerGB int64 = 1024 * 1024 * 1024
@@ -33,7 +31,7 @@ type namedConfigItem struct {
 	Name string `json:"name"`
 }

-func (h *Handler) processFlowItem(nodeID int64, item flowItem) {
+func (h *Handler) processFlowItem(item flowItem) {
 	serviceName := strings.TrimSpace(item.N)
 	if serviceName == "" || serviceName == "web_api" {
 		return
@@ -43,7 +41,6 @@ func (h *Handler) processFlowItem(nodeID int64, item flowItem) {
 	if ok {
 		inFlow, outFlow := h.scaleFlowByTunnel(forwardID, item.D, item.U)
 		_ = h.repo.AddFlow(forwardID, userID, userTunnelID, inFlow, outFlow)
-		h.processPeerShareFlowFromForward(forwardID, nodeID, serviceName, item)

 		if userTunnelID > 0 {
 			h.enforceFlowPolicies(userID, userTunnelID)
@@ -91,45 +88,6 @@ func parsePeerShareRuntimeServiceID(serviceName string) (int64, bool) {
 	return runtimeID, true
 }

-func parsePeerShareInfoFromFederationTunnelName(tunnelName string) (int64, int, bool) {
-	tunnelName = strings.TrimSpace(tunnelName)
-	if !strings.HasPrefix(tunnelName, "Share-") {
-		return 0, 0, false
-	}
-	raw := strings.TrimPrefix(tunnelName, "Share-")
-	idx := strings.Index(raw, "-Port-")
-	if idx <= 0 {
-		return 0, 0, false
-	}
-	shareID, err := strconv.ParseInt(raw[:idx], 10, 64)
-	if err != nil || shareID <= 0 {
-		return 0, 0, false
-	}
-	portValue := strings.TrimSpace(raw[idx+len("-Port-"):])
-	port, err := strconv.Atoi(portValue)
-	if err != nil || port <= 0 {
-		return 0, 0, false
-	}
-	return shareID, port, true
-}
-
-func parsePeerShareIDFromFederationTunnelName(tunnelName string) (int64, bool) {
-	tunnelName = strings.TrimSpace(tunnelName)
-	if !strings.HasPrefix(tunnelName, "Share-") {
-		return 0, false
-	}
-	raw := strings.TrimPrefix(tunnelName, "Share-")
-	idx := strings.Index(raw, "-Port-")
-	if idx <= 0 {
-		return 0, false
-	}
-	shareID, err := strconv.ParseInt(raw[:idx], 10, 64)
-	if err != nil || shareID <= 0 {
-		return 0, false
-	}
-	return shareID, true
-}
-
 func (h *Handler) processPeerShareFlow(runtimeID int64, item flowItem) {
 	if h == nil || h.repo == nil || runtimeID <= 0 {
 		return
@@ -156,121 +114,6 @@ func (h *Handler) processPeerShareFlow(runtimeID int64, item flowItem) {
 	h.enforcePeerShareFlowLimit(share.ID)
 }

-func (h *Handler) processPeerShareFlowFromForward(forwardID int64, nodeID int64, serviceName string, item flowItem) {
-	if h == nil || h.repo == nil || forwardID <= 0 {
-		return
-	}
-
-	delta := item.D + item.U
-	if delta <= 0 {
-		return
-	}
-
-	forward, err := h.getForwardRecord(forwardID)
-	if err != nil || forward == nil {
-		// Forward not found in local database - might be a federation port-forward
-		// Try to find by service name in peer_share_runtime
-		h.processPeerShareFlowByServiceName(nodeID, serviceName, item)
-		return
-	}
-	tunnelName, err := h.repo.GetTunnelName(forward.TunnelID)
-	if err != nil {
-		h.processPeerShareFlowByServiceName(nodeID, serviceName, item)
-		return
-	}
-	shareID, ok := parsePeerShareIDFromFederationTunnelName(tunnelName)
-	if !ok {
-		h.processPeerShareFlowByServiceName(nodeID, serviceName, item)
-		return
-	}
-
-	if err := h.repo.AddPeerShareCurrentFlow(shareID, delta); err != nil {
-		h.processPeerShareFlowByServiceName(nodeID, serviceName, item)
-		return
-	}
-
-	share, err := h.repo.GetPeerShare(shareID)
-	if err != nil || share == nil {
-		return
-	}
-	if !isPeerShareFlowExceeded(share) {
-		return
-	}
-	h.enforcePeerShareFlowLimit(share.ID)
-}
-
-func normalizeForwardRuntimeServiceName(serviceName string) string {
-	name := strings.TrimSpace(serviceName)
-	if strings.HasSuffix(name, "_tcp") {
-		return strings.TrimSuffix(name, "_tcp")
-	}
-	if strings.HasSuffix(name, "_udp") {
-		return strings.TrimSuffix(name, "_udp")
-	}
-	return name
-}
-
-func (h *Handler) processPeerShareFlowByServiceName(nodeID int64, serviceName string, item flowItem) {
-	if h == nil || h.repo == nil || strings.TrimSpace(serviceName) == "" {
-		return
-	}
-
-	delta := item.D + item.U
-	if delta <= 0 {
-		return
-	}
-
-	normalized := normalizeForwardRuntimeServiceName(serviceName)
-	var runtimes []model.PeerShareRuntime
-	var err error
-
-	// Try node-scoped query first if nodeID is valid
-	if nodeID > 0 {
-		runtimes, err = h.repo.ListActiveForwardPeerShareRuntimesByNodeAndServiceName(nodeID, normalized)
-		if err != nil {
-			return
-		}
-		if len(runtimes) == 0 && normalized != serviceName {
-			runtimes, err = h.repo.ListActiveForwardPeerShareRuntimesByNodeAndServiceName(nodeID, serviceName)
-			if err != nil {
-				return
-			}
-		}
-	}
-
-	// Fallback to global query if node-scoped query returned nothing or nodeID is invalid
-	if len(runtimes) == 0 {
-		runtimes, err = h.repo.ListActiveForwardPeerShareRuntimesByServiceName(normalized)
-		if err != nil {
-			return
-		}
-		if len(runtimes) == 0 && normalized != serviceName {
-			runtimes, err = h.repo.ListActiveForwardPeerShareRuntimesByServiceName(serviceName)
-			if err != nil {
-				return
-			}
-		}
-	}
-
-	if len(runtimes) != 1 {
-		if len(runtimes) > 1 {
-			log.Printf("WARN: ambiguous peer share runtime match for service=%s nodeID=%d count=%d", serviceName, nodeID, len(runtimes))
-		}
-		return
-	}
-	runtime := runtimes[0]
-
-	_ = h.repo.AddPeerShareCurrentFlow(runtime.ShareID, delta)
-
-	matchedShare, err := h.repo.GetPeerShare(runtime.ShareID)
-	if err != nil || matchedShare == nil {
-		return
-	}
-	if isPeerShareFlowExceeded(matchedShare) {
-		h.enforcePeerShareFlowLimit(matchedShare.ID)
-	}
-}
-
 func (h *Handler) enforcePeerShareFlowLimit(shareID int64) {
 	if h == nil || h.repo == nil || shareID <= 0 {
 		return
@@ -364,18 +207,22 @@ func (h *Handler) getUserTunnelPolicy(userTunnelID int64) (*userTunnelPolicy, er
 	if userTunnelID <= 0 {
 		return nil, nil
 	}
-	ut, err := h.repo.GetUserTunnelByID(userTunnelID)
-	if err != nil {
+
+	row := h.repo.DB().QueryRow(`
+		SELECT id, user_id, tunnel_id, flow, in_flow, out_flow, exp_time, status
+		FROM user_tunnel
+		WHERE id = ?
+		LIMIT 1
+	`, userTunnelID)
+
+	var policy userTunnelPolicy
+	if err := row.Scan(&policy.ID, &policy.UserID, &policy.TunnelID, &policy.Flow, &policy.InFlow, &policy.OutFlow, &policy.ExpTime, &policy.Status); err != nil {
+		if err == sql.ErrNoRows {
+			return nil, nil
+		}
 		return nil, err
 	}
-	if ut == nil {
-		return nil, nil
-	}
-	return &userTunnelPolicy{
-		ID: ut.ID, UserID: ut.UserID, TunnelID: ut.TunnelID,
-		Flow: ut.Flow, InFlow: ut.InFlow, OutFlow: ut.OutFlow,
-		ExpTime: ut.ExpTime, Status: ut.Status,
-	}, nil
+	return &policy, nil
 }

 func (h *Handler) pauseUserForwards(userID int64, now int64) {
@@ -398,20 +245,60 @@ func (h *Handler) pauseForwardRecords(forwards []forwardRecord, now int64) {
 	for i := range forwards {
 		forward := forwards[i]
 		_ = h.controlForwardServices(&forward, "PauseService", false)
-		_ = h.repo.UpdateForwardStatus(forward.ID, 0, now)
+		_, _ = h.repo.DB().Exec(`UPDATE forward SET status = 0, updated_time = ? WHERE id = ?`, now, forward.ID)
 	}
 }

 func (h *Handler) listActiveForwardsByUser(userID int64) ([]forwardRecord, error) {
-	return h.repo.ListActiveForwardsByUser(userID)
+	rows, err := h.repo.DB().Query(`
+		SELECT id, user_id, user_name, name, tunnel_id, remote_addr, COALESCE(strategy, 'fifo'), status
+		FROM forward
+		WHERE user_id = ? AND status = 1
+		ORDER BY id ASC
+	`, userID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	return scanForwardRecords(rows)
 }

 func (h *Handler) listActiveForwardsByUserTunnel(userID int64, tunnelID int64) ([]forwardRecord, error) {
-	return h.repo.ListActiveForwardsByUserTunnel(userID, tunnelID)
+	rows, err := h.repo.DB().Query(`
+		SELECT id, user_id, user_name, name, tunnel_id, remote_addr, COALESCE(strategy, 'fifo'), status
+		FROM forward
+		WHERE user_id = ? AND tunnel_id = ? AND status = 1
+		ORDER BY id ASC
+	`, userID, tunnelID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	return scanForwardRecords(rows)
+}
+
+func scanForwardRecords(rows *sql.Rows) ([]forwardRecord, error) {
+	out := make([]forwardRecord, 0)
+	for rows.Next() {
+		var record forwardRecord
+		if err := rows.Scan(&record.ID, &record.UserID, &record.UserName, &record.Name, &record.TunnelID, &record.RemoteAddr, &record.Strategy, &record.Status); err != nil {
+			return nil, err
+		}
+		if strings.TrimSpace(record.Strategy) == "" {
+			record.Strategy = "fifo"
+		}
+		out = append(out, record)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return out, nil
 }

 func (h *Handler) cleanNodeConfigs(nodeID int64, rawConfig string) {
-	if h == nil || h.repo == nil || nodeID <= 0 {
+	if h == nil || h.repo == nil || h.repo.DB() == nil || nodeID <= 0 {
 		return
 	}
 	if strings.TrimSpace(rawConfig) == "" {
@@ -429,46 +316,15 @@ func (h *Handler) cleanNodeConfigs(nodeID int64, rawConfig string) {
 }

 func (h *Handler) cleanOrphanedServices(nodeID int64, services []namedConfigItem) {
-	runtimeServiceNames, err := h.repo.ListActiveForwardPeerShareRuntimeServiceNamesByNode(nodeID)
-	if err != nil {
-		return
-	}
-	minUpdatedTime := time.Now().Add(-10 * time.Minute).UnixMilli()
-	hasUnboundForwardPeerRuntime, err := h.repo.HasRecentUnboundForwardPeerShareRuntimeOnNode(nodeID, minUpdatedTime)
-	if err != nil {
-		hasUnboundForwardPeerRuntime = false
-	}
-	runtimeServiceSet := make(map[string]struct{}, len(runtimeServiceNames))
-	for _, serviceName := range runtimeServiceNames {
-		serviceName = strings.TrimSpace(serviceName)
-		if serviceName == "" {
-			continue
-		}
-		runtimeServiceSet[serviceName] = struct{}{}
-	}
-
 	for _, item := range services {
 		name := strings.TrimSpace(item.Name)
 		if name == "" || name == "web_api" {
 			continue
 		}
-		if strings.HasPrefix(name, "fed_svc_") {
-			continue
-		}
-		normalizedName := normalizeForwardRuntimeServiceName(name)
-		if _, ok := runtimeServiceSet[normalizedName]; ok {
-			continue
-		}
-		if _, ok := runtimeServiceSet[name]; ok {
-			continue
-		}

 		parts := strings.Split(name, "_")
 		if len(parts) >= 3 {
 			forwardID, err := strconv.ParseInt(parts[0], 10, 64)
-			if err == nil && forwardID > 0 && hasUnboundForwardPeerRuntime {
-				continue
-			}
 			if err == nil && forwardID > 0 && !h.forwardExists(forwardID) {
 				_, _ = h.sendNodeCommand(nodeID, "DeleteService", map[string]interface{}{"services": []string{name, parts[0] + "_" + parts[1] + "_" + parts[2], parts[0] + "_" + parts[1] + "_" + parts[2] + "_tcp", parts[0] + "_" + parts[1] + "_" + parts[2] + "_udp"}}, false, true)
 				continue
@@ -488,9 +344,6 @@ func (h *Handler) cleanOrphanedServices(nodeID int64, services []namedConfigItem
 				continue
 			}
 			forwardID, err := strconv.ParseInt(parts[0], 10, 64)
-			if err == nil && forwardID > 0 && hasUnboundForwardPeerRuntime {
-				continue
-			}
 			if err != nil || forwardID <= 0 || h.forwardExists(forwardID) {
 				continue
 			}
@@ -530,13 +383,15 @@ func (h *Handler) cleanOrphanedLimiters(nodeID int64, limiters []namedConfigItem
 }

 func (h *Handler) tunnelExists(tunnelID int64) bool {
-	ok, _ := h.repo.TunnelExists(tunnelID)
-	return ok
+	var count int
+	err := h.repo.DB().QueryRow(`SELECT COUNT(1) FROM tunnel WHERE id = ?`, tunnelID).Scan(&count)
+	return err == nil && count > 0
 }

 func (h *Handler) forwardExists(forwardID int64) bool {
-	ok, _ := h.repo.ForwardExists(forwardID)
-	return ok
+	var count int
+	err := h.repo.DB().QueryRow(`SELECT COUNT(1) FROM forward WHERE id = ?`, forwardID).Scan(&count)
+	return err == nil && count > 0
 }

 func (h *Handler) speedLimiterExists(name string) bool {
@@ -547,6 +402,8 @@ func (h *Handler) speedLimiterExists(name string) bool {
 	if err != nil || id <= 0 {
 		return false
 	}
-	ok, _ := h.repo.SpeedLimitExists(id)
-	return ok
+
+	var count int
+	err = h.repo.DB().QueryRow(`SELECT COUNT(1) FROM speed_limit WHERE id = ?`, id).Scan(&count)
+	return err == nil && count > 0
 }
@@ -2,22 +2,21 @@ package handler

 import (
 	"path/filepath"
-	"strconv"
 	"testing"
 	"time"

-	"go-backend/internal/store/repo"
+	"go-backend/internal/store/sqlite"
 )

 func TestProcessFlowItemTracksPeerShareFlowAndEnforcesLimit(t *testing.T) {
-	r, err := repo.Open(filepath.Join(t.TempDir(), "panel.db"))
+	repo, err := sqlite.Open(filepath.Join(t.TempDir(), "panel.db"))
 	if err != nil {
 		t.Fatalf("open repo: %v", err)
 	}
-	defer r.Close()
+	defer repo.Close()

 	now := time.Now().UnixMilli()
-	if err := r.CreatePeerShare(&repo.PeerShare{
+	if err := repo.CreatePeerShare(&sqlite.PeerShare{
 		Name:           "flow-share",
 		NodeID:         1,
 		Token:          "flow-share-token",
@@ -31,22 +30,22 @@ func TestProcessFlowItemTracksPeerShareFlowAndEnforcesLimit(t *testing.T) {
 	}); err != nil {
 		t.Fatalf("create peer share: %v", err)
 	}
-	share, err := r.GetPeerShareByToken("flow-share-token")
+	share, err := repo.GetPeerShareByToken("flow-share-token")
 	if err != nil || share == nil {
 		t.Fatalf("load peer share: %v", err)
 	}

-	if err := r.DB().Exec(`
+	if _, err := repo.DB().Exec(`
 		INSERT INTO peer_share_runtime(id, share_id, node_id, reservation_id, resource_key, binding_id, role, chain_name, service_name, protocol, strategy, port, target, applied, status, created_time, updated_time)
 		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, 17, share.ID, share.NodeID, "res-17", "rk-17", "17", "exit", "", "fed_svc_17", "tls", "round", 32001, "", 1, 1, now, now).Error; err != nil {
+	`, 17, share.ID, share.NodeID, "res-17", "rk-17", "17", "exit", "", "fed_svc_17", "tls", "round", 32001, "", 1, 1, now, now); err != nil {
 		t.Fatalf("insert peer_share_runtime: %v", err)
 	}

-	h := &Handler{repo: r}
-	h.processFlowItem(1, flowItem{N: "fed_svc_17", U: 1200, D: 900})
+	h := &Handler{repo: repo}
+	h.processFlowItem(flowItem{N: "fed_svc_17", U: 1200, D: 900})

-	updatedShare, err := r.GetPeerShare(share.ID)
+	updatedShare, err := repo.GetPeerShare(share.ID)
 	if err != nil || updatedShare == nil {
 		t.Fatalf("reload share: %v", err)
 	}
@@ -54,7 +53,7 @@ func TestProcessFlowItemTracksPeerShareFlowAndEnforcesLimit(t *testing.T) {
 		t.Fatalf("expected current_flow=3100, got %d", updatedShare.CurrentFlow)
 	}

-	runtime, err := r.GetPeerShareRuntimeByID(17)
+	runtime, err := repo.GetPeerShareRuntimeByID(17)
 	if err != nil || runtime == nil {
 		t.Fatalf("reload runtime: %v", err)
 	}
@@ -62,345 +61,3 @@ func TestProcessFlowItemTracksPeerShareFlowAndEnforcesLimit(t *testing.T) {
 		t.Fatalf("expected runtime status=0 after limit enforcement, got %d", runtime.Status)
 	}
 }
-
-func TestProcessFlowItemTracksPeerShareFlowForFederationPortForward(t *testing.T) {
-	r, err := repo.Open(filepath.Join(t.TempDir(), "panel-forward.db"))
-	if err != nil {
-		t.Fatalf("open repo: %v", err)
-	}
-	defer r.Close()
-
-	now := time.Now().UnixMilli()
-	if err := r.CreatePeerShare(&repo.PeerShare{
-		Name:           "forward-share",
-		NodeID:         1,
-		Token:          "forward-share-token",
-		MaxBandwidth:   0,
-		CurrentFlow:    0,
-		PortRangeStart: 30000,
-		PortRangeEnd:   30010,
-		IsActive:       1,
-		CreatedTime:    now,
-		UpdatedTime:    now,
-	}); err != nil {
-		t.Fatalf("create peer share: %v", err)
-	}
-	share, err := r.GetPeerShareByToken("forward-share-token")
-	if err != nil || share == nil {
-		t.Fatalf("load peer share: %v", err)
-	}
-
-	if err := r.DB().Exec(`
-		INSERT INTO user(id, user, pwd, role_id, exp_time, flow, in_flow, out_flow, flow_reset_time, num, created_time, updated_time, status)
-		VALUES(2, 'u2', 'x', 1, ?, 99999, 0, 0, 1, 1, ?, ?, 1)
-	`, now+24*60*60*1000, now, now).Error; err != nil {
-		t.Fatalf("insert user: %v", err)
-	}
-
-	tunnelName := "Share-" + strconv.FormatInt(share.ID, 10) + "-Port-30001"
-	if err := r.DB().Exec(`
-		INSERT INTO tunnel(id, name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
-		VALUES(1, ?, 1.0, 1, 'tls', 1, ?, ?, 1, NULL, 0)
-	`, tunnelName, now, now).Error; err != nil {
-		t.Fatalf("insert tunnel: %v", err)
-	}
-
-	if err := r.DB().Exec(`
-		INSERT INTO user_tunnel(id, user_id, tunnel_id, speed_id, num, flow, in_flow, out_flow, flow_reset_time, exp_time, status)
-		VALUES(10, 2, 1, NULL, 1, 99999, 0, 0, 1, ?, 1)
-	`, now+24*60*60*1000).Error; err != nil {
-		t.Fatalf("insert user_tunnel: %v", err)
-	}
-
-	if err := r.DB().Exec(`
-		INSERT INTO forward(id, user_id, user_name, name, tunnel_id, remote_addr, strategy, in_flow, out_flow, created_time, updated_time, status, inx)
-		VALUES(20, 2, 'u2', 'f20', 1, '1.1.1.1:443', 'fifo', 0, 0, ?, ?, 1, 0)
-	`, now, now).Error; err != nil {
-		t.Fatalf("insert forward: %v", err)
-	}
-
-	h := &Handler{repo: r}
-	h.processFlowItem(1, flowItem{N: "20_2_10", U: 120, D: 80})
-
-	updatedShare, err := r.GetPeerShare(share.ID)
-	if err != nil || updatedShare == nil {
-		t.Fatalf("reload share: %v", err)
-	}
-	if updatedShare.CurrentFlow != 200 {
-		t.Fatalf("expected current_flow=200, got %d", updatedShare.CurrentFlow)
-	}
-}
-
-func TestProcessFlowItemTracksPeerShareFlowByForwardServiceName(t *testing.T) {
-	r, err := repo.Open(filepath.Join(t.TempDir(), "panel-forward-service.db"))
-	if err != nil {
-		t.Fatalf("open repo: %v", err)
-	}
-	defer r.Close()
-
-	now := time.Now().UnixMilli()
-	if err := r.CreatePeerShare(&repo.PeerShare{
-		Name:           "forward-service-share",
-		NodeID:         1,
-		Token:          "forward-service-token",
-		MaxBandwidth:   0,
-		CurrentFlow:    0,
-		PortRangeStart: 31000,
-		PortRangeEnd:   31010,
-		IsActive:       1,
-		CreatedTime:    now,
-		UpdatedTime:    now,
-	}); err != nil {
-		t.Fatalf("create peer share: %v", err)
-	}
-	share, err := r.GetPeerShareByToken("forward-service-token")
-	if err != nil || share == nil {
-		t.Fatalf("load peer share: %v", err)
-	}
-
-	if err := r.DB().Exec(`
-		INSERT INTO peer_share_runtime(share_id, node_id, reservation_id, resource_key, binding_id, role, chain_name, service_name, protocol, strategy, port, target, applied, status, created_time, updated_time)
-		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, share.ID, share.NodeID, "svc-r1", "svc-rk1", "", "forward", "", "20_2_10", "tcp", "fifo", 31001, "", 1, 1, now, now).Error; err != nil {
-		t.Fatalf("insert peer_share_runtime: %v", err)
-	}
-
-	h := &Handler{repo: r}
-	h.processFlowItem(1, flowItem{N: "20_2_10_tcp", U: 120, D: 80})
-
-	updatedShare, err := r.GetPeerShare(share.ID)
-	if err != nil || updatedShare == nil {
-		t.Fatalf("reload share: %v", err)
-	}
-	if updatedShare.CurrentFlow != 200 {
-		t.Fatalf("expected current_flow=200, got %d", updatedShare.CurrentFlow)
-	}
-}
-
-func TestProcessFlowItemFallsBackToServiceNameWhenForwardIDCollidesAcrossPanels(t *testing.T) {
-	r, err := repo.Open(filepath.Join(t.TempDir(), "panel-forward-collision.db"))
-	if err != nil {
-		t.Fatalf("open repo: %v", err)
-	}
-	defer r.Close()
-
-	now := time.Now().UnixMilli()
-	if err := r.CreatePeerShare(&repo.PeerShare{
-		Name:           "collision-share",
-		NodeID:         1,
-		Token:          "collision-token",
-		MaxBandwidth:   0,
-		CurrentFlow:    0,
-		PortRangeStart: 31400,
-		PortRangeEnd:   31410,
-		IsActive:       1,
-		CreatedTime:    now,
-		UpdatedTime:    now,
-	}); err != nil {
-		t.Fatalf("create peer share: %v", err)
-	}
-	share, err := r.GetPeerShareByToken("collision-token")
-	if err != nil || share == nil {
-		t.Fatalf("load peer share: %v", err)
-	}
-
-	if err := r.DB().Exec(`
-		INSERT INTO peer_share_runtime(share_id, node_id, reservation_id, resource_key, binding_id, role, chain_name, service_name, protocol, strategy, port, target, applied, status, created_time, updated_time)
-		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, share.ID, share.NodeID, "collision-r1", "collision-rk1", "", "forward", "", "20_2_10", "tcp", "fifo", 31401, "", 1, 1, now, now).Error; err != nil {
-		t.Fatalf("insert peer_share_runtime: %v", err)
-	}
-
-	if err := r.DB().Exec(`
-		INSERT INTO tunnel(id, name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
-		VALUES(2, 'local-tunnel-with-colliding-forward-id', 1.0, 1, 'tls', 1, ?, ?, 1, NULL, 0)
-	`, now, now).Error; err != nil {
-		t.Fatalf("insert local tunnel: %v", err)
-	}
-
-	if err := r.DB().Exec(`
-		INSERT INTO forward(id, user_id, user_name, name, tunnel_id, remote_addr, strategy, in_flow, out_flow, created_time, updated_time, status, inx)
-		VALUES(20, 1, 'local-user', 'local-f20', 2, '8.8.8.8:53', 'fifo', 0, 0, ?, ?, 1, 0)
-	`, now, now).Error; err != nil {
-		t.Fatalf("insert local forward: %v", err)
-	}
-
-	h := &Handler{repo: r}
-	h.processFlowItem(1, flowItem{N: "20_2_10_tcp", U: 120, D: 80})
-
-	updatedShare, err := r.GetPeerShare(share.ID)
-	if err != nil || updatedShare == nil {
-		t.Fatalf("reload share: %v", err)
-	}
-	if updatedShare.CurrentFlow != 200 {
-		t.Fatalf("expected current_flow=200, got %d", updatedShare.CurrentFlow)
-	}
-}
-
-func TestProcessFlowItemSkipsPeerShareFlowWhenServiceNameIsAmbiguous(t *testing.T) {
-	r, err := repo.Open(filepath.Join(t.TempDir(), "panel-forward-ambiguous.db"))
-	if err != nil {
-		t.Fatalf("open repo: %v", err)
-	}
-	defer r.Close()
-
-	now := time.Now().UnixMilli()
-	if err := r.CreatePeerShare(&repo.PeerShare{
-		Name:           "ambiguous-share-a",
-		NodeID:         1,
-		Token:          "ambiguous-token-a",
-		MaxBandwidth:   0,
-		CurrentFlow:    0,
-		PortRangeStart: 31100,
-		PortRangeEnd:   31110,
-		IsActive:       1,
-		CreatedTime:    now,
-		UpdatedTime:    now,
-	}); err != nil {
-		t.Fatalf("create share A: %v", err)
-	}
-	if err := r.CreatePeerShare(&repo.PeerShare{
-		Name:           "ambiguous-share-b",
-		NodeID:         1,
-		Token:          "ambiguous-token-b",
-		MaxBandwidth:   0,
-		CurrentFlow:    0,
-		PortRangeStart: 31200,
-		PortRangeEnd:   31210,
-		IsActive:       1,
-		CreatedTime:    now,
-		UpdatedTime:    now,
-	}); err != nil {
-		t.Fatalf("create share B: %v", err)
-	}
-	shareA, _ := r.GetPeerShareByToken("ambiguous-token-a")
-	shareB, _ := r.GetPeerShareByToken("ambiguous-token-b")
-
-	if err := r.DB().Exec(`
-		INSERT INTO peer_share_runtime(share_id, node_id, reservation_id, resource_key, binding_id, role, chain_name, service_name, protocol, strategy, port, target, applied, status, created_time, updated_time)
-		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?),
-		      (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`,
-		shareA.ID, 1, "amb-r1", "amb-rk1", "", "forward", "", "99_2_10", "tcp", "fifo", 31101, "", 1, 1, now, now,
-		shareB.ID, 1, "amb-r2", "amb-rk2", "", "forward", "", "99_2_10", "tcp", "fifo", 31201, "", 1, 1, now, now,
-	).Error; err != nil {
-		t.Fatalf("insert ambiguous runtimes: %v", err)
-	}
-
-	h := &Handler{repo: r}
-	h.processFlowItem(1, flowItem{N: "99_2_10_tcp", U: 120, D: 80})
-
-	updatedA, _ := r.GetPeerShare(shareA.ID)
-	updatedB, _ := r.GetPeerShare(shareB.ID)
-	if updatedA.CurrentFlow != 0 || updatedB.CurrentFlow != 0 {
-		t.Fatalf("expected ambiguous service flow to be skipped, got shareA=%d shareB=%d", updatedA.CurrentFlow, updatedB.CurrentFlow)
-	}
-}
-
-func TestCleanOrphanedServicesSkipsActiveSharedForwardRuntimeServices(t *testing.T) {
-	r, err := repo.Open(filepath.Join(t.TempDir(), "panel-cleanup-runtime.db"))
-	if err != nil {
-		t.Fatalf("open repo: %v", err)
-	}
-	defer r.Close()
-
-	now := time.Now().UnixMilli()
-	if err := r.CreatePeerShare(&repo.PeerShare{
-		Name:           "cleanup-runtime-share",
-		NodeID:         1,
-		Token:          "cleanup-runtime-token",
-		MaxBandwidth:   0,
-		CurrentFlow:    0,
-		PortRangeStart: 31300,
-		PortRangeEnd:   31310,
-		IsActive:       1,
-		CreatedTime:    now,
-		UpdatedTime:    now,
-	}); err != nil {
-		t.Fatalf("create peer share: %v", err)
-	}
-	share, err := r.GetPeerShareByToken("cleanup-runtime-token")
-	if err != nil || share == nil {
-		t.Fatalf("load peer share: %v", err)
-	}
-
-	if err := r.DB().Exec(`
-		INSERT INTO peer_share_runtime(share_id, node_id, reservation_id, resource_key, binding_id, role, chain_name, service_name, protocol, strategy, port, target, applied, status, created_time, updated_time)
-		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, share.ID, share.NodeID, "cleanup-r1", "cleanup-rk1", "", "forward", "", "20_2_10", "tcp", "fifo", 31301, "", 1, 1, now, now).Error; err != nil {
-		t.Fatalf("insert peer_share_runtime: %v", err)
-	}
-
-	h := &Handler{repo: r}
-
-	defer func() {
-		if rec := recover(); rec != nil {
-			t.Fatalf("cleanOrphanedServices should skip active shared runtime service; got panic: %v", rec)
-		}
-	}()
-
-	h.cleanOrphanedServices(share.NodeID, []namedConfigItem{{Name: "20_2_10_tcp"}})
-}
-
-func TestCleanOrphanedServicesSkipsFederationServicePrefix(t *testing.T) {
-	r, err := repo.Open(filepath.Join(t.TempDir(), "panel-cleanup-fed-svc.db"))
-	if err != nil {
-		t.Fatalf("open repo: %v", err)
-	}
-	defer r.Close()
-
-	h := &Handler{repo: r}
-
-	defer func() {
-		if rec := recover(); rec != nil {
-			t.Fatalf("cleanOrphanedServices should skip fed_svc_ service names; got panic: %v", rec)
-		}
-	}()
-
-	h.cleanOrphanedServices(1, []namedConfigItem{{Name: "fed_svc_999_tcp"}})
-}
-
-func TestCleanOrphanedServicesSkipsForwardPatternWhenNodeHasActivePeerShareForwardRuntime(t *testing.T) {
-	r, err := repo.Open(filepath.Join(t.TempDir(), "panel-cleanup-forward-runtime-empty-service.db"))
-	if err != nil {
-		t.Fatalf("open repo: %v", err)
-	}
-	defer r.Close()
-
-	now := time.Now().UnixMilli()
-	if err := r.CreatePeerShare(&repo.PeerShare{
-		Name:           "cleanup-forward-runtime-empty-service",
-		NodeID:         1,
-		Token:          "cleanup-forward-runtime-empty-service-token",
-		MaxBandwidth:   0,
-		CurrentFlow:    0,
-		PortRangeStart: 31420,
-		PortRangeEnd:   31430,
-		IsActive:       1,
-		CreatedTime:    now,
-		UpdatedTime:    now,
-	}); err != nil {
-		t.Fatalf("create peer share: %v", err)
-	}
-	share, err := r.GetPeerShareByToken("cleanup-forward-runtime-empty-service-token")
-	if err != nil || share == nil {
-		t.Fatalf("load peer share: %v", err)
-	}
-
-	if err := r.DB().Exec(`
-		INSERT INTO peer_share_runtime(share_id, node_id, reservation_id, resource_key, binding_id, role, chain_name, service_name, protocol, strategy, port, target, applied, status, created_time, updated_time)
-		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, share.ID, share.NodeID, "cleanup-forward-empty-r1", "cleanup-forward-empty-rk1", "", "forward", "", "", "tcp", "fifo", 31421, "", 0, 1, now, now).Error; err != nil {
-		t.Fatalf("insert peer_share_runtime with empty service name: %v", err)
-	}
-
-	h := &Handler{repo: r}
-
-	defer func() {
-		if rec := recover(); rec != nil {
-			t.Fatalf("cleanOrphanedServices should skip forward-pattern services when active peer-share forward runtime exists; got panic: %v", rec)
-		}
-	}()
-
-	h.cleanOrphanedServices(share.NodeID, []namedConfigItem{{Name: "20_2_10_tcp"}})
-}
@@ -3,7 +3,6 @@ package handler
 import (
 	"context"
 	"database/sql"
-	"encoding/base64"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -19,12 +18,12 @@ import (
 	"go-backend/internal/http/middleware"
 	"go-backend/internal/http/response"
 	"go-backend/internal/security"
-	"go-backend/internal/store/repo"
+	"go-backend/internal/store/sqlite"
 	"go-backend/internal/ws"
 )

 type Handler struct {
-	repo      *repo.Repository
+	repo      *sqlite.Repository
 	jwtSecret string
 	wsServer  *ws.Server

@@ -35,9 +34,6 @@ type Handler struct {
 	jobsCancel  context.CancelFunc
 	jobsStarted bool
 	jobsWG      sync.WaitGroup
-
-	upgradeMu              sync.Mutex
-	pendingUpgradeRedeploy map[int64]struct{}
 }

 type loginRequest struct {
@@ -73,21 +69,13 @@ type flowItem struct {
 	D int64  `json:"d"`
 }

-const (
-	pngDataURLPrefix          = "data:image/png;base64,"
-	maxBrandAssetDataURLBytes = 1024 * 1024
-)
-
-func New(repo *repo.Repository, jwtSecret string) *Handler {
-	h := &Handler{
-		repo:                   repo,
-		jwtSecret:              jwtSecret,
-		wsServer:               ws.NewServer(repo, jwtSecret),
-		captchaTokens:          make(map[string]int64),
-		pendingUpgradeRedeploy: make(map[int64]struct{}),
+func New(repo *sqlite.Repository, jwtSecret string) *Handler {
+	return &Handler{
+		repo:          repo,
+		jwtSecret:     jwtSecret,
+		wsServer:      ws.NewServer(repo, jwtSecret),
+		captchaTokens: make(map[string]int64),
 	}
-	h.wsServer.SetNodeOnlineHook(h.onNodeOnline)
-	return h
 }

 func (h *Handler) WebSocketHandler() http.Handler {
@@ -101,7 +89,6 @@ func (h *Handler) Register(mux *http.ServeMux) {
 	mux.HandleFunc("/api/v1/user/update", h.userUpdate)
 	mux.HandleFunc("/api/v1/user/delete", h.userDelete)
 	mux.HandleFunc("/api/v1/user/reset", h.userResetFlow)
-	mux.HandleFunc("/api/v1/user/groups", h.userGroups)
 	mux.HandleFunc("/api/v1/config/get", h.getConfigByName)
 	mux.HandleFunc("/api/v1/config/list", h.getConfigs)
 	mux.HandleFunc("/api/v1/config/update", h.updateConfigs)
@@ -134,7 +121,6 @@ func (h *Handler) Register(mux *http.ServeMux) {
 	mux.HandleFunc("/api/v1/tunnel/update", h.tunnelUpdate)
 	mux.HandleFunc("/api/v1/tunnel/delete", h.tunnelDelete)
 	mux.HandleFunc("/api/v1/tunnel/diagnose", h.tunnelDiagnose)
-	mux.HandleFunc("/api/v1/tunnel/diagnose/stream", h.tunnelDiagnoseStream)
 	mux.HandleFunc("/api/v1/tunnel/update-order", h.tunnelUpdateOrder)
 	mux.HandleFunc("/api/v1/tunnel/batch-delete", h.tunnelBatchDelete)
 	mux.HandleFunc("/api/v1/tunnel/batch-redeploy", h.tunnelBatchRedeploy)
@@ -150,7 +136,6 @@ func (h *Handler) Register(mux *http.ServeMux) {
 	mux.HandleFunc("/api/v1/forward/pause", h.forwardPause)
 	mux.HandleFunc("/api/v1/forward/resume", h.forwardResume)
 	mux.HandleFunc("/api/v1/forward/diagnose", h.forwardDiagnose)
-	mux.HandleFunc("/api/v1/forward/diagnose/stream", h.forwardDiagnoseStream)
 	mux.HandleFunc("/api/v1/forward/update-order", h.forwardUpdateOrder)
 	mux.HandleFunc("/api/v1/forward/batch-delete", h.forwardBatchDelete)
 	mux.HandleFunc("/api/v1/forward/batch-pause", h.forwardBatchPause)
@@ -161,6 +146,7 @@ func (h *Handler) Register(mux *http.ServeMux) {
 	mux.HandleFunc("/api/v1/speed-limit/create", h.speedLimitCreate)
 	mux.HandleFunc("/api/v1/speed-limit/update", h.speedLimitUpdate)
 	mux.HandleFunc("/api/v1/speed-limit/delete", h.speedLimitDelete)
+	mux.HandleFunc("/api/v1/speed-limit/tunnels", h.tunnelList)
 	mux.HandleFunc("/api/v1/tunnel/user/tunnel", h.userTunnelVisibleList)
 	mux.HandleFunc("/api/v1/tunnel/user/list", h.userTunnelList)
 	mux.HandleFunc("/api/v1/group/tunnel/list", h.tunnelGroupList)
@@ -191,8 +177,6 @@ func (h *Handler) Register(mux *http.ServeMux) {
 	mux.HandleFunc("/api/v1/federation/runtime/diagnose", h.authPeer(h.federationRuntimeDiagnose))
 	mux.HandleFunc("/api/v1/federation/runtime/command", h.authPeer(h.federationRuntimeCommand))
 	mux.HandleFunc("/api/v1/federation/node/import", h.nodeImport)
-	mux.HandleFunc("/api/v1/announcement/get", h.getAnnouncement)
-	mux.HandleFunc("/api/v1/announcement/update", h.updateAnnouncement)

 	mux.HandleFunc("/flow/test", h.flowTest)
 	mux.HandleFunc("/flow/config", h.flowConfig)
@@ -226,7 +210,7 @@ func (h *Handler) login(w http.ResponseWriter, r *http.Request) {
 		response.WriteJSON(w, response.Err(-2, err.Error()))
 		return
 	}
-	if captchaEnabled && !h.apiClientCaptchaBypassEnabled(r) {
+	if captchaEnabled {
 		captchaID := strings.TrimSpace(req.CaptchaID)
 		if captchaID == "" {
 			response.WriteJSON(w, response.ErrDefault("验证码校验失败"))
@@ -440,7 +424,7 @@ func (h *Handler) openAPISubStore(w http.ResponseWriter, r *http.Request) {
 		response.WriteJSON(w, response.ErrDefault("请求失败"))
 		return
 	}
-	if h == nil || h.repo == nil {
+	if h == nil || h.repo == nil || h.repo.DB() == nil {
 		response.WriteJSON(w, response.Err(-2, "database unavailable"))
 		return
 	}
@@ -483,21 +467,27 @@ func (h *Handler) openAPISubStore(w http.ResponseWriter, r *http.Request) {
 			return
 		}

-		ut, err := h.repo.GetUserTunnelByID(tunnelID)
+		var userID int64
+		var inFlow int64
+		var outFlow int64
+		var flow int64
+		var expTime int64
+		err = h.repo.DB().QueryRow(`SELECT user_id, in_flow, out_flow, flow, exp_time FROM user_tunnel WHERE id = ? LIMIT 1`, tunnelID).
+			Scan(&userID, &inFlow, &outFlow, &flow, &expTime)
 		if err != nil {
+			if err == sql.ErrNoRows {
+				response.WriteJSON(w, response.ErrDefault("隧道不存在"))
+				return
+			}
 			response.WriteJSON(w, response.Err(-2, err.Error()))
 			return
 		}
-		if ut == nil {
-			response.WriteJSON(w, response.ErrDefault("隧道不存在"))
-			return
-		}
-		if ut.UserID != user.ID {
+		if userID != user.ID {
 			response.WriteJSON(w, response.ErrDefault("隧道不存在"))
 			return
 		}

-		headerValue = buildSubscriptionHeader(ut.OutFlow, ut.InFlow, ut.Flow*giga, ut.ExpTime/1000)
+		headerValue = buildSubscriptionHeader(outFlow, inFlow, flow*giga, expTime/1000)
 	}

 	w.Header().Set("subscription-userinfo", headerValue)
@@ -711,8 +701,7 @@ func (h *Handler) flowConfig(w http.ResponseWriter, r *http.Request) {

 func (h *Handler) flowUpload(w http.ResponseWriter, r *http.Request) {
 	secret := r.URL.Query().Get("secret")
-	node, _ := h.repo.GetNodeBySecret(secret)
-	if node == nil {
+	if ok, _ := h.repo.NodeExistsBySecret(secret); !ok {
 		w.Header().Set("Content-Type", "text/plain; charset=utf-8")
 		_, _ = w.Write([]byte("ok"))
 		return
@@ -723,7 +712,7 @@ func (h *Handler) flowUpload(w http.ResponseWriter, r *http.Request) {
 		var items []flowItem
 		if json.Unmarshal([]byte(raw), &items) == nil {
 			for _, item := range items {
-				h.processFlowItem(node.ID, item)
+				h.processFlowItem(item)
 			}
 		}
 	}
@@ -754,14 +743,7 @@ func (h *Handler) updateConfigs(w http.ResponseWriter, r *http.Request) {
 		if key == "" {
 			continue
 		}
-
-		value, err := normalizeAndValidateConfigValue(key, v)
-		if err != nil {
-			response.WriteJSON(w, response.ErrDefault(err.Error()))
-			return
-		}
-
-		if err := h.repo.UpsertConfig(key, value, now); err != nil {
+		if err := h.repo.UpsertConfig(key, v, now); err != nil {
 			response.WriteJSON(w, response.Err(-2, err.Error()))
 			return
 		}
@@ -781,24 +763,16 @@ func (h *Handler) updateSingleConfig(w http.ResponseWriter, r *http.Request) {
 		response.WriteJSON(w, response.ErrDefault("配置名称不能为空"))
 		return
 	}
-	name := strings.TrimSpace(req.Name)
-	if name == "" {
+	if strings.TrimSpace(req.Name) == "" {
 		response.WriteJSON(w, response.ErrDefault("配置名称不能为空"))
 		return
 	}
-
-	value, err := normalizeAndValidateConfigValue(name, req.Value)
-	if err != nil {
-		response.WriteJSON(w, response.ErrDefault(err.Error()))
-		return
-	}
-
-	if value == "" && name != "app_logo" && name != "app_favicon" {
+	if strings.TrimSpace(req.Value) == "" {
 		response.WriteJSON(w, response.ErrDefault("配置值不能为空"))
 		return
 	}

-	if err := h.repo.UpsertConfig(name, value, time.Now().UnixMilli()); err != nil {
+	if err := h.repo.UpsertConfig(strings.TrimSpace(req.Name), req.Value, time.Now().UnixMilli()); err != nil {
 		response.WriteJSON(w, response.Err(-2, err.Error()))
 		return
 	}
@@ -806,37 +780,6 @@ func (h *Handler) updateSingleConfig(w http.ResponseWriter, r *http.Request) {
 	response.WriteJSON(w, response.OKEmpty())
 }

-func normalizeAndValidateConfigValue(key, value string) (string, error) {
-	switch strings.TrimSpace(key) {
-	case "app_logo", "app_favicon":
-		normalized := strings.TrimSpace(value)
-		if normalized == "" {
-			return "", nil
-		}
-
-		if !strings.HasPrefix(normalized, pngDataURLPrefix) {
-			return "", fmt.Errorf("品牌图片必须通过上传生成 PNG 数据")
-		}
-
-		if len(normalized) > maxBrandAssetDataURLBytes {
-			return "", fmt.Errorf("品牌图片过大，请上传更小图片")
-		}
-
-		payload := strings.TrimSpace(strings.TrimPrefix(normalized, pngDataURLPrefix))
-		if payload == "" {
-			return "", fmt.Errorf("品牌图片数据不能为空")
-		}
-
-		if _, err := base64.StdEncoding.DecodeString(payload); err != nil {
-			return "", fmt.Errorf("品牌图片数据格式无效")
-		}
-
-		return pngDataURLPrefix + payload, nil
-	default:
-		return value, nil
-	}
-}
-
 func (h *Handler) userPackage(w http.ResponseWriter, r *http.Request) {
 	if r.Method != http.MethodPost {
 		response.WriteJSON(w, response.ErrDefault("请求失败"))
@@ -1042,41 +985,10 @@ func (h *Handler) captchaEnabled() (bool, error) {
 	if err != nil {
 		return false, err
 	}
-	if cfg == nil || !strings.EqualFold(strings.TrimSpace(cfg.Value), "true") {
+	if cfg == nil {
 		return false, nil
 	}
-
-	siteCfg, err := h.repo.GetConfigByName("cloudflare_site_key")
-	if err != nil {
-		return false, err
-	}
-	if siteCfg == nil || strings.TrimSpace(siteCfg.Value) == "" {
-		return false, nil
-	}
-
-	secretCfg, err := h.repo.GetConfigByName("cloudflare_secret_key")
-	if err != nil {
-		return false, err
-	}
-	if secretCfg == nil || strings.TrimSpace(secretCfg.Value) == "" {
-		return false, nil
-	}
-
-	return true, nil
-}
-
-func (h *Handler) apiClientCaptchaBypassEnabled(r *http.Request) bool {
-	if r == nil {
-		return false
-	}
-
-	client := strings.ToLower(strings.TrimSpace(r.Header.Get("X-FLVX-API-Client")))
-	switch client {
-	case "whmcs", "whmcs-module":
-		return true
-	default:
-		return false
-	}
+	return strings.EqualFold(cfg.Value, "true"), nil
 }

 func (h *Handler) markCaptchaToken(token string) {
@@ -1276,7 +1188,7 @@ func (h *Handler) backupExport(w http.ResponseWriter, r *http.Request) {

 type backupImportRequest struct {
 	Types []string `json:"types"`
-	repo.BackupData
+	sqlite.BackupData
 }

 func (h *Handler) backupImport(w http.ResponseWriter, r *http.Request) {
@@ -1316,53 +1228,3 @@ func (h *Handler) backupImport(w http.ResponseWriter, r *http.Request) {
 	result.AutoBackup = autoBackup
 	response.WriteJSON(w, response.OK(result))
 }
-
-func (h *Handler) getAnnouncement(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
-		response.WriteJSON(w, response.ErrDefault("请求失败"))
-		return
-	}
-
-	ann, err := h.repo.GetAnnouncement()
-	if err != nil {
-		response.WriteJSON(w, response.Err(-1, fmt.Sprintf("获取公告失败: %v", err)))
-		return
-	}
-
-	if ann == nil {
-		response.WriteJSON(w, response.OK(map[string]interface{}{
-			"content": "",
-			"enabled": 0,
-		}))
-		return
-	}
-
-	response.WriteJSON(w, response.OK(map[string]interface{}{
-		"content": ann.Content,
-		"enabled": ann.Enabled,
-	}))
-}
-
-func (h *Handler) updateAnnouncement(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
-		response.WriteJSON(w, response.ErrDefault("请求失败"))
-		return
-	}
-
-	var req struct {
-		Content string `json:"content"`
-		Enabled int    `json:"enabled"`
-	}
-	if err := decodeJSON(r.Body, &req); err != nil {
-		response.WriteJSON(w, response.Err(500, "请求参数错误"))
-		return
-	}
-
-	now := time.Now().UnixMilli()
-	if err := h.repo.UpsertAnnouncement(req.Content, req.Enabled, now); err != nil {
-		response.WriteJSON(w, response.Err(-1, fmt.Sprintf("更新公告失败: %v", err)))
-		return
-	}
-
-	response.WriteJSON(w, response.OKEmpty())
-}
@@ -2,11 +2,12 @@ package handler

 import (
 	"context"
+	"database/sql"
 	"time"
 )

 func (h *Handler) StartBackgroundJobs() {
-	if h == nil || h.repo == nil {
+	if h == nil || h.repo == nil || h.repo.DB() == nil {
 		return
 	}

@@ -96,28 +97,47 @@ func durationUntilNextDailyMaintenance(now time.Time) time.Duration {
 }

 func (h *Handler) runStatisticsFlowJob(now time.Time) {
-	if h == nil || h.repo == nil {
+	if h == nil || h.repo == nil || h.repo.DB() == nil {
 		return
 	}

+	db := h.repo.DB()
 	nowMs := now.UnixMilli()
 	cutoffMs := nowMs - int64((48*time.Hour)/time.Millisecond)
-	_ = h.repo.PurgeOldStatisticsFlows(cutoffMs)
+	_, _ = db.Exec(`DELETE FROM statistics_flow WHERE created_time < ?`, cutoffMs)

 	hourMark := now.Truncate(time.Hour)
 	hourText := hourMark.Format("15:04")
 	createdTime := hourMark.UnixMilli()

-	users, err := h.repo.ListAllUserFlowSnapshots()
+	rows, err := db.Query(`SELECT id, in_flow, out_flow FROM user ORDER BY id ASC`)
 	if err != nil {
 		return
 	}
+	type userFlowSnapshot struct {
+		userID  int64
+		inFlow  int64
+		outFlow int64
+	}
+	users := make([]userFlowSnapshot, 0)
+
+	for rows.Next() {
+		var userID int64
+		var inFlow int64
+		var outFlow int64
+		if err := rows.Scan(&userID, &inFlow, &outFlow); err != nil {
+			continue
+		}
+		users = append(users, userFlowSnapshot{userID: userID, inFlow: inFlow, outFlow: outFlow})
+	}
+	_ = rows.Close()

 	for _, user := range users {
-		currentTotal := user.InFlow + user.OutFlow
+		currentTotal := user.inFlow + user.outFlow
 		increment := currentTotal

-		lastTotal, err := h.repo.GetLastStatisticsFlowTotal(user.UserID)
+		var lastTotal sql.NullInt64
+		err := db.QueryRow(`SELECT total_flow FROM statistics_flow WHERE user_id = ? ORDER BY id DESC LIMIT 1`, user.userID).Scan(&lastTotal)
 		if err == nil && lastTotal.Valid {
 			increment = currentTotal - lastTotal.Int64
 			if increment < 0 {
@@ -125,12 +145,15 @@ func (h *Handler) runStatisticsFlowJob(now time.Time) {
 			}
 		}

-		_ = h.repo.CreateStatisticsFlow(user.UserID, increment, currentTotal, hourText, createdTime)
+		_, _ = db.Exec(`
+			INSERT INTO statistics_flow(user_id, flow, total_flow, time, created_time)
+			VALUES(?, ?, ?, ?, ?)
+		`, user.userID, increment, currentTotal, hourText, createdTime)
 	}
 }

 func (h *Handler) runResetAndExpiryJob(now time.Time) {
-	if h == nil || h.repo == nil {
+	if h == nil || h.repo == nil || h.repo.DB() == nil {
 		return
 	}

@@ -140,39 +163,108 @@ func (h *Handler) runResetAndExpiryJob(now time.Time) {
 }

 func (h *Handler) resetMonthlyFlow(now time.Time) {
+	db := h.repo.DB()
 	currentDay := now.Day()
 	lastDay := time.Date(now.Year(), now.Month()+1, 0, 0, 0, 0, 0, now.Location()).Day()

-	_ = h.repo.ResetUserMonthlyFlow(currentDay, lastDay)
-	_ = h.repo.ResetUserTunnelMonthlyFlow(currentDay, lastDay)
+	if currentDay == lastDay {
+		_, _ = db.Exec(`
+			UPDATE user
+			SET in_flow = 0, out_flow = 0
+			WHERE flow_reset_time != 0
+			  AND (flow_reset_time = ? OR flow_reset_time > ?)
+		`, currentDay, lastDay)
+		_, _ = db.Exec(`
+			UPDATE user_tunnel
+			SET in_flow = 0, out_flow = 0
+			WHERE flow_reset_time != 0
+			  AND (flow_reset_time = ? OR flow_reset_time > ?)
+		`, currentDay, lastDay)
+		return
+	}
+
+	_, _ = db.Exec(`
+		UPDATE user
+		SET in_flow = 0, out_flow = 0
+		WHERE flow_reset_time != 0
+		  AND flow_reset_time = ?
+	`, currentDay)
+	_, _ = db.Exec(`
+		UPDATE user_tunnel
+		SET in_flow = 0, out_flow = 0
+		WHERE flow_reset_time != 0
+		  AND flow_reset_time = ?
+	`, currentDay)
 }

 func (h *Handler) disableExpiredUsers(nowMs int64) {
-	userIDs, err := h.repo.ListExpiredActiveUserIDs(nowMs)
+	db := h.repo.DB()
+	rows, err := db.Query(`
+		SELECT id
+		FROM user
+		WHERE role_id != 0
+		  AND status = 1
+		  AND exp_time IS NOT NULL
+		  AND exp_time < ?
+	`, nowMs)
 	if err != nil {
 		return
 	}
+	userIDs := make([]int64, 0)
+
+	for rows.Next() {
+		var userID int64
+		if err := rows.Scan(&userID); err != nil {
+			continue
+		}
+		userIDs = append(userIDs, userID)
+	}
+	_ = rows.Close()

 	for _, userID := range userIDs {
 		forwards, err := h.listActiveForwardsByUser(userID)
 		if err == nil {
 			h.pauseForwardRecords(forwards, nowMs)
 		}
-		_ = h.repo.DisableUser(userID)
+		_, _ = db.Exec(`UPDATE user SET status = 0 WHERE id = ?`, userID)
 	}
 }

 func (h *Handler) disableExpiredUserTunnels(nowMs int64) {
-	items, err := h.repo.ListExpiredActiveUserTunnels(nowMs)
+	db := h.repo.DB()
+	rows, err := db.Query(`
+		SELECT id, user_id, tunnel_id
+		FROM user_tunnel
+		WHERE status = 1
+		  AND exp_time IS NOT NULL
+		  AND exp_time < ?
+	`, nowMs)
 	if err != nil {
 		return
 	}
+	type expiredUserTunnel struct {
+		userTunnelID int64
+		userID       int64
+		tunnelID     int64
+	}
+	items := make([]expiredUserTunnel, 0)
+
+	for rows.Next() {
+		var userTunnelID int64
+		var userID int64
+		var tunnelID int64
+		if err := rows.Scan(&userTunnelID, &userID, &tunnelID); err != nil {
+			continue
+		}
+		items = append(items, expiredUserTunnel{userTunnelID: userTunnelID, userID: userID, tunnelID: tunnelID})
+	}
+	_ = rows.Close()

 	for _, item := range items {
-		forwards, err := h.listActiveForwardsByUserTunnel(item.UserID, item.TunnelID)
+		forwards, err := h.listActiveForwardsByUserTunnel(item.userID, item.tunnelID)
 		if err == nil {
 			h.pauseForwardRecords(forwards, nowMs)
 		}
-		_ = h.repo.DisableUserTunnel(item.ID)
+		_, _ = db.Exec(`UPDATE user_tunnel SET status = 0 WHERE id = ?`, item.userTunnelID)
 	}
 }
@@ -5,40 +5,48 @@ import (
 	"testing"
 	"time"

-	"go-backend/internal/store/repo"
+	"go-backend/internal/store/sqlite"
 )

 func TestRunStatisticsFlowJobTracksIncrementAndPrunes(t *testing.T) {
 	dbPath := filepath.Join(t.TempDir(), "jobs-stats.db")
-	r, err := repo.Open(dbPath)
+	repo, err := sqlite.Open(dbPath)
 	if err != nil {
 		t.Fatalf("open sqlite: %v", err)
 	}
-	t.Cleanup(func() { _ = r.Close() })
+	t.Cleanup(func() { _ = repo.Close() })

-	h := New(r, "secret")
+	h := New(repo, "secret")
 	now := time.Date(2026, 2, 7, 12, 0, 0, 0, time.UTC)
 	nowMs := now.UnixMilli()

-	if err := r.DB().Exec(`UPDATE user SET in_flow = 100, out_flow = 200 WHERE id = 1`).Error; err != nil {
+	if _, err := repo.DB().Exec(`UPDATE user SET in_flow = 100, out_flow = 200 WHERE id = 1`); err != nil {
 		t.Fatalf("seed user flow: %v", err)
 	}

-	if err := r.DB().Exec(`INSERT INTO statistics_flow(user_id, flow, total_flow, time, created_time) VALUES(1, 250, 250, '11:00', ?)`, now.Add(-time.Hour).UnixMilli()).Error; err != nil {
+	if _, err := repo.DB().Exec(`INSERT INTO statistics_flow(user_id, flow, total_flow, time, created_time) VALUES(1, 250, 250, '11:00', ?)`, now.Add(-time.Hour).UnixMilli()); err != nil {
 		t.Fatalf("seed recent statistics row: %v", err)
 	}
-	if err := r.DB().Exec(`INSERT INTO statistics_flow(user_id, flow, total_flow, time, created_time) VALUES(1, 10, 10, '00:00', ?)`, now.Add(-49*time.Hour).UnixMilli()).Error; err != nil {
+	if _, err := repo.DB().Exec(`INSERT INTO statistics_flow(user_id, flow, total_flow, time, created_time) VALUES(1, 10, 10, '00:00', ?)`, now.Add(-49*time.Hour).UnixMilli()); err != nil {
 		t.Fatalf("seed stale statistics row: %v", err)
 	}

 	h.runStatisticsFlowJob(now)

-	staleCount := mustQueryInt(t, r, `SELECT COUNT(1) FROM statistics_flow WHERE created_time < ?`, nowMs-int64((48*time.Hour)/time.Millisecond))
+	var staleCount int
+	if err := repo.DB().QueryRow(`SELECT COUNT(1) FROM statistics_flow WHERE created_time < ?`, nowMs-int64((48*time.Hour)/time.Millisecond)).Scan(&staleCount); err != nil {
+		t.Fatalf("query stale statistics rows: %v", err)
+	}
 	if staleCount != 0 {
 		t.Fatalf("expected stale statistics rows to be pruned, got %d", staleCount)
 	}

-	flow, total, hour := mustQueryInt64Int64String(t, r, `SELECT flow, total_flow, time FROM statistics_flow WHERE user_id = 1 ORDER BY id DESC LIMIT 1`)
+	var flow int64
+	var total int64
+	var hour string
+	if err := repo.DB().QueryRow(`SELECT flow, total_flow, time FROM statistics_flow WHERE user_id = 1 ORDER BY id DESC LIMIT 1`).Scan(&flow, &total, &hour); err != nil {
+		t.Fatalf("query latest statistics row: %v", err)
+	}
 	if flow != 50 {
 		t.Fatalf("expected increment flow 50, got %d", flow)
 	}
@@ -52,94 +60,69 @@ func TestRunStatisticsFlowJobTracksIncrementAndPrunes(t *testing.T) {

 func TestRunResetAndExpiryJobResetsFlowAndDisablesExpiredRecords(t *testing.T) {
 	dbPath := filepath.Join(t.TempDir(), "jobs-reset.db")
-	r, err := repo.Open(dbPath)
+	repo, err := sqlite.Open(dbPath)
 	if err != nil {
 		t.Fatalf("open sqlite: %v", err)
 	}
-	t.Cleanup(func() { _ = r.Close() })
+	t.Cleanup(func() { _ = repo.Close() })

-	h := New(r, "secret")
+	h := New(repo, "secret")
 	now := time.Date(2026, 3, 15, 0, 0, 5, 0, time.UTC)
 	nowMs := now.UnixMilli()

-	if err := r.DB().Exec(`
+	if _, err := repo.DB().Exec(`
 		INSERT INTO user(id, user, pwd, role_id, exp_time, flow, in_flow, out_flow, flow_reset_time, num, created_time, updated_time, status)
 		VALUES(2, 'expired_user', 'x', 1, ?, 100, 1000, 2000, 15, 1, ?, ?, 1)
-	`, nowMs-1000, nowMs, nowMs).Error; err != nil {
+	`, nowMs-1000, nowMs, nowMs); err != nil {
 		t.Fatalf("insert expired user: %v", err)
 	}

-	if err := r.DB().Exec(`
-		INSERT INTO user(id, user, pwd, role_id, exp_time, flow, in_flow, out_flow, flow_reset_time, num, created_time, updated_time, status)
-		VALUES(3, 'non_expiring_user', 'x', 1, 0, 100, 1000, 2000, 15, 1, ?, ?, 1)
-	`, nowMs, nowMs).Error; err != nil {
-		t.Fatalf("insert non-expiring user: %v", err)
-	}
-
-	if err := r.DB().Exec(`
+	if _, err := repo.DB().Exec(`
 		INSERT INTO tunnel(id, name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
 		VALUES(1, 't1', 1.0, 1, 'tls', 1, ?, ?, 1, NULL, 0)
-	`, nowMs, nowMs).Error; err != nil {
+	`, nowMs, nowMs); err != nil {
 		t.Fatalf("insert tunnel: %v", err)
 	}

-	if err := r.DB().Exec(`
+	if _, err := repo.DB().Exec(`
 		INSERT INTO user_tunnel(id, user_id, tunnel_id, speed_id, num, flow, in_flow, out_flow, flow_reset_time, exp_time, status)
 		VALUES(10, 2, 1, NULL, 1, 1, 300, 400, 15, ?, 1)
-	`, nowMs-1000).Error; err != nil {
+	`, nowMs-1000); err != nil {
 		t.Fatalf("insert expired user_tunnel: %v", err)
 	}

-	if err := r.DB().Exec(`
-		INSERT INTO user_tunnel(id, user_id, tunnel_id, speed_id, num, flow, in_flow, out_flow, flow_reset_time, exp_time, status)
-		VALUES(11, 3, 1, NULL, 1, 1, 300, 400, 15, 0, 1)
-	`).Error; err != nil {
-		t.Fatalf("insert non-expiring user_tunnel: %v", err)
-	}
-
-	if err := r.DB().Exec(`
+	if _, err := repo.DB().Exec(`
 		INSERT INTO forward(id, user_id, user_name, name, tunnel_id, remote_addr, strategy, in_flow, out_flow, created_time, updated_time, status, inx)
 		VALUES(20, 2, 'expired_user', 'f1', 1, '1.1.1.1:443', 'fifo', 0, 0, ?, ?, 1, 0)
-	`, nowMs, nowMs).Error; err != nil {
+	`, nowMs, nowMs); err != nil {
 		t.Fatalf("insert forward: %v", err)
 	}

-	if err := r.DB().Exec(`
-		INSERT INTO forward(id, user_id, user_name, name, tunnel_id, remote_addr, strategy, in_flow, out_flow, created_time, updated_time, status, inx)
-		VALUES(21, 3, 'non_expiring_user', 'f2', 1, '1.1.1.1:443', 'fifo', 0, 0, ?, ?, 1, 1)
-	`, nowMs, nowMs).Error; err != nil {
-		t.Fatalf("insert non-expiring forward: %v", err)
-	}
-
 	h.runResetAndExpiryJob(now)

-	userIn, userOut, userStatus := mustQueryInt64Int64Int(t, r, `SELECT in_flow, out_flow, status FROM user WHERE id = 2`)
+	var userIn, userOut int64
+	var userStatus int
+	if err := repo.DB().QueryRow(`SELECT in_flow, out_flow, status FROM user WHERE id = 2`).Scan(&userIn, &userOut, &userStatus); err != nil {
+		t.Fatalf("query user after maintenance: %v", err)
+	}
 	if userIn != 0 || userOut != 0 || userStatus != 0 {
 		t.Fatalf("expected user reset+disabled, got in=%d out=%d status=%d", userIn, userOut, userStatus)
 	}

-	utIn, utOut, utStatus := mustQueryInt64Int64Int(t, r, `SELECT in_flow, out_flow, status FROM user_tunnel WHERE id = 10`)
+	var utIn, utOut int64
+	var utStatus int
+	if err := repo.DB().QueryRow(`SELECT in_flow, out_flow, status FROM user_tunnel WHERE id = 10`).Scan(&utIn, &utOut, &utStatus); err != nil {
+		t.Fatalf("query user_tunnel after maintenance: %v", err)
+	}
 	if utIn != 0 || utOut != 0 || utStatus != 0 {
 		t.Fatalf("expected user_tunnel reset+disabled, got in=%d out=%d status=%d", utIn, utOut, utStatus)
 	}

-	forwardStatus := mustQueryInt(t, r, `SELECT status FROM forward WHERE id = 20`)
+	var forwardStatus int
+	if err := repo.DB().QueryRow(`SELECT status FROM forward WHERE id = 20`).Scan(&forwardStatus); err != nil {
+		t.Fatalf("query forward after maintenance: %v", err)
+	}
 	if forwardStatus != 0 {
 		t.Fatalf("expected forward status=0 after expiry handling, got %d", forwardStatus)
 	}
-
-	nonExpUserStatus := mustQueryInt(t, r, `SELECT status FROM user WHERE id = 3`)
-	if nonExpUserStatus != 1 {
-		t.Fatalf("expected non-expiring user to remain enabled, got status=%d", nonExpUserStatus)
-	}
-
-	nonExpTunnelStatus := mustQueryInt(t, r, `SELECT status FROM user_tunnel WHERE id = 11`)
-	if nonExpTunnelStatus != 1 {
-		t.Fatalf("expected non-expiring user_tunnel to remain enabled, got status=%d", nonExpTunnelStatus)
-	}
-
-	nonExpForwardStatus := mustQueryInt(t, r, `SELECT status FROM forward WHERE id = 21`)
-	if nonExpForwardStatus != 1 {
-		t.Fatalf("expected non-expiring forward to remain enabled, got status=%d", nonExpForwardStatus)
-	}
 }
@@ -1,79 +0,0 @@
-package handler
-
-import (
-	"path/filepath"
-	"testing"
-	"time"
-
-	"go-backend/internal/store/repo"
-)
-
-func TestReconstructTunnelState_PreservesConnectIP(t *testing.T) {
-	dbPath := filepath.Join(t.TempDir(), "reconstruct-connect-ip.db")
-	r, err := repo.Open(dbPath)
-	if err != nil {
-		t.Fatalf("open sqlite: %v", err)
-	}
-	t.Cleanup(func() { _ = r.Close() })
-
-	h := New(r, "secret")
-	now := time.Now().UnixMilli()
-
-	if err := r.DB().Exec(`
-		INSERT INTO tunnel(id, name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
-		VALUES(1, 'reconstruct-tunnel', 1.0, 2, 'tls', 1, ?, ?, 1, NULL, 0)
-	`, now, now).Error; err != nil {
-		t.Fatalf("insert tunnel: %v", err)
-	}
-
-	insertNode := func(id int64, name, ip string) {
-		if err := r.DB().Exec(`
-			INSERT INTO node(id, name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx)
-			VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-		`, id, name, name+"-secret", ip, ip, "", "30000-30010", "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", 0).Error; err != nil {
-			t.Fatalf("insert node %s: %v", name, err)
-		}
-	}
-
-	insertNode(101, "entry", "10.90.0.10")
-	insertNode(102, "middle", "10.90.0.20")
-	insertNode(103, "exit", "10.90.0.30")
-
-	if err := r.DB().Exec(`
-		INSERT INTO chain_tunnel(tunnel_id, chain_type, node_id, port, strategy, inx, protocol)
-		VALUES(1, '1', 101, 30001, 'round', 1, 'tls')
-	`).Error; err != nil {
-		t.Fatalf("insert entry chain: %v", err)
-	}
-	if err := r.DB().Exec(`
-		INSERT INTO chain_tunnel(tunnel_id, chain_type, node_id, port, strategy, inx, protocol, connect_ip)
-		VALUES(1, '2', 102, 30002, 'round', 1, 'tls', '10.99.9.22')
-	`).Error; err != nil {
-		t.Fatalf("insert middle chain: %v", err)
-	}
-	if err := r.DB().Exec(`
-		INSERT INTO chain_tunnel(tunnel_id, chain_type, node_id, port, strategy, inx, protocol, connect_ip)
-		VALUES(1, '3', 103, 30003, 'round', 1, 'tls', '10.99.9.33')
-	`).Error; err != nil {
-		t.Fatalf("insert exit chain: %v", err)
-	}
-
-	state, err := h.reconstructTunnelState(1)
-	if err != nil {
-		t.Fatalf("reconstructTunnelState: %v", err)
-	}
-
-	if len(state.ChainHops) != 1 || len(state.ChainHops[0]) != 1 {
-		t.Fatalf("unexpected chain hops: %+v", state.ChainHops)
-	}
-	if got := state.ChainHops[0][0].ConnectIP; got != "10.99.9.22" {
-		t.Fatalf("expected middle connectIp 10.99.9.22, got %q", got)
-	}
-
-	if len(state.OutNodes) != 1 {
-		t.Fatalf("unexpected out nodes: %+v", state.OutNodes)
-	}
-	if got := state.OutNodes[0].ConnectIP; got != "10.99.9.33" {
-		t.Fatalf("expected exit connectIp 10.99.9.33, got %q", got)
-	}
-}
@@ -5,7 +5,6 @@ import (
 	"fmt"
 	"io"
 	"net/http"
-	"regexp"
 	"strings"
 	"sync"
 	"time"
@@ -20,104 +19,8 @@ const (
 	githubHTMLBase = "https://github.com"
 	upgradeTimeout = 5 * time.Minute
 	batchWorkers   = 5
-
-	releaseChannelStable = "stable"
-	releaseChannelDev    = "dev"
 )

-var (
-	stableVersionPattern = regexp.MustCompile(`^\d+(?:\.\d+)+$`)
-	testKeywordPattern   = regexp.MustCompile(`(?i)(alpha|beta|rc)`)
-)
-
-type githubRelease struct {
-	TagName     string `json:"tag_name"`
-	Name        string `json:"name"`
-	PublishedAt string `json:"published_at"`
-	Prerelease  bool   `json:"prerelease"`
-	Draft       bool   `json:"draft"`
-}
-
-func normalizeReleaseChannel(channel string) string {
-	switch strings.ToLower(strings.TrimSpace(channel)) {
-	case releaseChannelDev:
-		return releaseChannelDev
-	default:
-		return releaseChannelStable
-	}
-}
-
-func releaseChannelFromTag(tag string) string {
-	normalized := strings.ToLower(strings.TrimSpace(tag))
-	if normalized == "" {
-		return releaseChannelDev
-	}
-	if testKeywordPattern.MatchString(normalized) {
-		return releaseChannelDev
-	}
-	if stableVersionPattern.MatchString(normalized) {
-		return releaseChannelStable
-	}
-
-	return releaseChannelDev
-}
-
-func releaseChannelLabel(channel string) string {
-	if normalizeReleaseChannel(channel) == releaseChannelDev {
-		return "测试版"
-	}
-
-	return "正式版"
-}
-
-func fetchGitHubReleases(perPage int) ([]githubRelease, error) {
-	if perPage <= 0 {
-		perPage = 20
-	}
-
-	client := &http.Client{Timeout: 15 * time.Second}
-	resp, err := client.Get(fmt.Sprintf("%s/repos/%s/releases?per_page=%d", githubAPIBase, githubRepo, perPage))
-	if err != nil {
-		return nil, fmt.Errorf("请求GitHub API失败: %v", err)
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		body, _ := io.ReadAll(io.LimitReader(resp.Body, 512))
-		return nil, fmt.Errorf("GitHub API返回 %d: %s", resp.StatusCode, string(body))
-	}
-
-	var releases []githubRelease
-	if err := json.NewDecoder(resp.Body).Decode(&releases); err != nil {
-		return nil, fmt.Errorf("解析GitHub API响应失败: %v", err)
-	}
-
-	return releases, nil
-}
-
-func resolveLatestReleaseByChannel(channel string) (string, error) {
-	normalizedChannel := normalizeReleaseChannel(channel)
-	releases, err := fetchGitHubReleases(50)
-	if err != nil {
-		return "", err
-	}
-
-	for _, r := range releases {
-		if r.Draft {
-			continue
-		}
-		tag := strings.TrimSpace(r.TagName)
-		if tag == "" {
-			continue
-		}
-		if releaseChannelFromTag(tag) == normalizedChannel {
-			return tag, nil
-		}
-	}
-
-	return "", fmt.Errorf("未找到%s版本号", releaseChannelLabel(normalizedChannel))
-}
-
 func (h *Handler) nodeUpgrade(w http.ResponseWriter, r *http.Request) {
 	if r.Method != http.MethodPost {
 		response.WriteJSON(w, response.ErrDefault("请求失败"))
@@ -127,7 +30,6 @@ func (h *Handler) nodeUpgrade(w http.ResponseWriter, r *http.Request) {
 	var req struct {
 		ID      int64  `json:"id"`
 		Version string `json:"version"`
-		Channel string `json:"channel"`
 	}
 	if err := decodeJSON(r.Body, &req); err != nil {
 		response.WriteJSON(w, response.ErrDefault("请求参数错误"))
@@ -138,13 +40,12 @@ func (h *Handler) nodeUpgrade(w http.ResponseWriter, r *http.Request) {
 		return
 	}

-	channel := normalizeReleaseChannel(req.Channel)
 	version := strings.TrimSpace(req.Version)
 	if version == "" {
 		var err error
-		version, err = resolveLatestReleaseByChannel(channel)
+		version, err = resolveLatestRelease()
 		if err != nil {
-			response.WriteJSON(w, response.Err(-2, fmt.Sprintf("获取最新%s失败: %v", releaseChannelLabel(channel), err)))
+			response.WriteJSON(w, response.Err(-2, fmt.Sprintf("获取最新版本失败: %v", err)))
 			return
 		}
 	}
@@ -166,7 +67,6 @@ func (h *Handler) nodeUpgrade(w http.ResponseWriter, r *http.Request) {
 		response.WriteJSON(w, response.Err(-2, fmt.Sprintf("升级失败: %v", err)))
 		return
 	}
-	h.markNodePendingUpgradeRedeploy(req.ID)

 	response.WriteJSON(w, response.OK(map[string]interface{}{
 		"version": version,
@@ -175,11 +75,61 @@ func (h *Handler) nodeUpgrade(w http.ResponseWriter, r *http.Request) {
 }

 func resolveLatestRelease() (string, error) {
-	return resolveLatestReleaseByChannel(releaseChannelStable)
+	client := &http.Client{
+		CheckRedirect: func(req *http.Request, via []*http.Request) error {
+			return http.ErrUseLastResponse
+		},
+		Timeout: 10 * time.Second,
+	}
+
+	resp, err := client.Get(githubProxy + "/" + githubHTMLBase + "/" + githubRepo + "/releases/latest")
+	if err != nil {
+		return "", fmt.Errorf("请求GitHub失败: %v", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusFound && resp.StatusCode != http.StatusMovedPermanently {
+		return resolveLatestReleaseAPI()
+	}
+
+	location := resp.Header.Get("Location")
+	if location == "" {
+		return resolveLatestReleaseAPI()
+	}
+
+	parts := strings.Split(location, "/")
+	tag := parts[len(parts)-1]
+	if tag == "" || tag == "latest" {
+		return resolveLatestReleaseAPI()
+	}
+
+	return tag, nil
 }

 func resolveLatestReleaseAPI() (string, error) {
-	return resolveLatestReleaseByChannel(releaseChannelStable)
+	client := &http.Client{Timeout: 10 * time.Second}
+	resp, err := client.Get(githubAPIBase + "/repos/" + githubRepo + "/releases/latest")
+	if err != nil {
+		return "", fmt.Errorf("请求GitHub API失败: %v", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(io.LimitReader(resp.Body, 512))
+		return "", fmt.Errorf("GitHub API返回 %d: %s", resp.StatusCode, string(body))
+	}
+
+	var release struct {
+		TagName string `json:"tag_name"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&release); err != nil {
+		return "", fmt.Errorf("解析GitHub API响应失败: %v", err)
+	}
+	if strings.TrimSpace(release.TagName) == "" {
+		return "", fmt.Errorf("无法从GitHub获取最新版本号")
+	}
+
+	return release.TagName, nil
 }

 func (h *Handler) nodeBatchUpgrade(w http.ResponseWriter, r *http.Request) {
@@ -191,7 +141,6 @@ func (h *Handler) nodeBatchUpgrade(w http.ResponseWriter, r *http.Request) {
 	var req struct {
 		IDs     []int64 `json:"ids"`
 		Version string  `json:"version"`
-		Channel string  `json:"channel"`
 	}
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
 		response.WriteJSON(w, response.ErrDefault("请求参数错误"))
@@ -202,13 +151,12 @@ func (h *Handler) nodeBatchUpgrade(w http.ResponseWriter, r *http.Request) {
 		return
 	}

-	channel := normalizeReleaseChannel(req.Channel)
 	version := strings.TrimSpace(req.Version)
 	if version == "" {
 		var err error
-		version, err = resolveLatestReleaseByChannel(channel)
+		version, err = resolveLatestRelease()
 		if err != nil {
-			response.WriteJSON(w, response.Err(-2, fmt.Sprintf("获取最新%s失败: %v", releaseChannelLabel(channel), err)))
+			response.WriteJSON(w, response.Err(-2, fmt.Sprintf("获取最新版本失败: %v", err)))
 			return
 		}
 	}
@@ -247,7 +195,6 @@ func (h *Handler) nodeBatchUpgrade(w http.ResponseWriter, r *http.Request) {
 				results[index] = upgradeResult{ID: nodeID, Success: false, Message: err.Error()}
 				return
 			}
-			h.markNodePendingUpgradeRedeploy(nodeID)
 			results[index] = upgradeResult{ID: nodeID, Success: true, Message: result.Message}
 		}(i, id)
 	}
@@ -265,19 +212,29 @@ func (h *Handler) listReleases(w http.ResponseWriter, r *http.Request) {
 		return
 	}

-	var req struct {
-		Channel string `json:"channel"`
+	client := &http.Client{Timeout: 15 * time.Second}
+	resp, err := client.Get(githubAPIBase + "/repos/" + githubRepo + "/releases?per_page=20")
+	if err != nil {
+		response.WriteJSON(w, response.Err(-2, fmt.Sprintf("获取版本列表失败: %v", err)))
+		return
 	}
-	if err := decodeJSON(r.Body, &req); err != nil && err != io.EOF {
-		response.WriteJSON(w, response.ErrDefault("请求参数错误"))
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(io.LimitReader(resp.Body, 512))
+		response.WriteJSON(w, response.Err(-2, fmt.Sprintf("获取版本列表失败: GitHub API返回 %d: %s", resp.StatusCode, string(body))))
 		return
 	}

-	channel := normalizeReleaseChannel(req.Channel)
-
-	releases, err := fetchGitHubReleases(50)
-	if err != nil {
-		response.WriteJSON(w, response.Err(-2, fmt.Sprintf("获取版本列表失败: %v", err)))
+	var releases []struct {
+		TagName     string `json:"tag_name"`
+		Name        string `json:"name"`
+		PublishedAt string `json:"published_at"`
+		Prerelease  bool   `json:"prerelease"`
+		Draft       bool   `json:"draft"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&releases); err != nil {
+		response.WriteJSON(w, response.Err(-2, fmt.Sprintf("解析版本列表失败: %v", err)))
 		return
 	}

@@ -286,7 +243,6 @@ func (h *Handler) listReleases(w http.ResponseWriter, r *http.Request) {
 		Name        string `json:"name"`
 		PublishedAt string `json:"publishedAt"`
 		Prerelease  bool   `json:"prerelease"`
-		Channel     string `json:"channel"`
 	}

 	items := make([]releaseItem, 0, len(releases))
@@ -294,20 +250,11 @@ func (h *Handler) listReleases(w http.ResponseWriter, r *http.Request) {
 		if r.Draft {
 			continue
 		}
-		tag := strings.TrimSpace(r.TagName)
-		if tag == "" {
-			continue
-		}
-		itemChannel := releaseChannelFromTag(tag)
-		if itemChannel != channel {
-			continue
-		}
 		items = append(items, releaseItem{
-			Version:     tag,
+			Version:     r.TagName,
 			Name:        r.Name,
 			PublishedAt: r.PublishedAt,
-			Prerelease:  itemChannel == releaseChannelDev,
-			Channel:     itemChannel,
+			Prerelease:  r.Prerelease,
 		})
 	}

@@ -342,66 +289,3 @@ func (h *Handler) nodeRollback(w http.ResponseWriter, r *http.Request) {
 		"message": result.Message,
 	}))
 }
-
-func (h *Handler) markNodePendingUpgradeRedeploy(nodeID int64) {
-	if h == nil || nodeID <= 0 {
-		return
-	}
-	h.upgradeMu.Lock()
-	h.pendingUpgradeRedeploy[nodeID] = struct{}{}
-	h.upgradeMu.Unlock()
-}
-
-func (h *Handler) consumeNodePendingUpgradeRedeploy(nodeID int64) bool {
-	if h == nil || nodeID <= 0 {
-		return false
-	}
-	h.upgradeMu.Lock()
-	_, ok := h.pendingUpgradeRedeploy[nodeID]
-	if ok {
-		delete(h.pendingUpgradeRedeploy, nodeID)
-	}
-	h.upgradeMu.Unlock()
-	return ok
-}
-
-func (h *Handler) onNodeOnline(nodeID int64) {
-	if !h.consumeNodePendingUpgradeRedeploy(nodeID) {
-		return
-	}
-	h.redeployNodeRuntimeAfterUpgrade(nodeID)
-}
-
-func (h *Handler) redeployNodeRuntimeAfterUpgrade(nodeID int64) {
-	tunnelIDs, err := h.repo.ListActiveTunnelIDsByNode(nodeID)
-	if err != nil {
-		fmt.Printf("post-upgrade redeploy: list tunnels for node %d failed: %v\n", nodeID, err)
-		return
-	}
-	forwardIDs, err := h.repo.ListActiveForwardIDsByNode(nodeID)
-	if err != nil {
-		fmt.Printf("post-upgrade redeploy: list forwards for node %d failed: %v\n", nodeID, err)
-		return
-	}
-
-	tunnelFailed := make(map[int64]struct{})
-	for _, tunnelID := range tunnelIDs {
-		if err := h.redeployTunnelAndForwards(tunnelID); err != nil {
-			tunnelFailed[tunnelID] = struct{}{}
-			fmt.Printf("post-upgrade redeploy: tunnel %d failed on node %d: %v\n", tunnelID, nodeID, err)
-		}
-	}
-
-	for _, forwardID := range forwardIDs {
-		forward, getErr := h.getForwardRecord(forwardID)
-		if getErr != nil || forward == nil {
-			continue
-		}
-		if _, skipped := tunnelFailed[forward.TunnelID]; skipped {
-			continue
-		}
-		if err := h.syncForwardServices(forward, "UpdateService", true); err != nil {
-			fmt.Printf("post-upgrade redeploy: forward %d failed on node %d: %v\n", forwardID, nodeID, err)
-		}
-	}
-}
@@ -1,46 +0,0 @@
-package handler
-
-import "testing"
-
-func TestReleaseChannelFromTag(t *testing.T) {
-	tests := []struct {
-		name    string
-		tag     string
-		expects string
-	}{
-		{name: "stable semantic version", tag: "2.1.4", expects: releaseChannelStable},
-		{name: "v prefix should be dev", tag: "v2.1.4", expects: releaseChannelDev},
-		{name: "rc release", tag: "2.1.4-rc2", expects: releaseChannelDev},
-		{name: "beta release", tag: "2.1.4-beta.1", expects: releaseChannelDev},
-		{name: "alpha release", tag: "2.1.4-alpha", expects: releaseChannelDev},
-		{name: "non numeric tag", tag: "nightly", expects: releaseChannelDev},
-		{name: "empty tag", tag: "", expects: releaseChannelDev},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			if got := releaseChannelFromTag(tc.tag); got != tc.expects {
-				t.Fatalf("releaseChannelFromTag(%q) = %q, want %q", tc.tag, got, tc.expects)
-			}
-		})
-	}
-}
-
-func TestNormalizeReleaseChannel(t *testing.T) {
-	tests := []struct {
-		input   string
-		expects string
-	}{
-		{input: "", expects: releaseChannelStable},
-		{input: "stable", expects: releaseChannelStable},
-		{input: "dev", expects: releaseChannelDev},
-		{input: "DEV", expects: releaseChannelDev},
-		{input: "preview", expects: releaseChannelStable},
-	}
-
-	for _, tc := range tests {
-		if got := normalizeReleaseChannel(tc.input); got != tc.expects {
-			t.Fatalf("normalizeReleaseChannel(%q) = %q, want %q", tc.input, got, tc.expects)
-		}
-	}
-}
@@ -137,8 +137,6 @@ func requiresAdmin(path string) bool {
 		return true
 	case "/api/v1/config/update", "/api/v1/config/update-single":
 		return true
-	case "/api/v1/announcement/update":
-		return true
 	default:
 		return false
 	}
@@ -0,0 +1,466 @@
+// Package store provides a thin dialect-aware wrapper around database/sql,
+// enabling transparent use of both SQLite and PostgreSQL.
+package store
+
+import (
+	"database/sql"
+	"strconv"
+	"strings"
+)
+
+// Dialect identifies the underlying database engine.
+type Dialect int
+
+const (
+	DialectSQLite Dialect = iota
+	DialectPostgres
+)
+
+// String returns a human-readable dialect name.
+func (d Dialect) String() string {
+	switch d {
+	case DialectSQLite:
+		return "sqlite"
+	case DialectPostgres:
+		return "postgres"
+	default:
+		return "unknown"
+	}
+}
+
+// DB wraps *sql.DB with dialect awareness.
+type DB struct {
+	raw     *sql.DB
+	dialect Dialect
+}
+
+// Wrap creates a new dialect-aware DB from an existing *sql.DB.
+func Wrap(raw *sql.DB, dialect Dialect) *DB {
+	return &DB{raw: raw, dialect: dialect}
+}
+
+// Dialect returns the database dialect.
+func (db *DB) Dialect() Dialect {
+	if db == nil {
+		return DialectSQLite
+	}
+	return db.dialect
+}
+
+// RawDB returns the underlying *sql.DB.
+func (db *DB) RawDB() *sql.DB {
+	if db == nil {
+		return nil
+	}
+	return db.raw
+}
+
+// Close closes the underlying connection.
+func (db *DB) Close() error {
+	if db == nil || db.raw == nil {
+		return nil
+	}
+	return db.raw.Close()
+}
+
+// Ping verifies the connection is alive.
+func (db *DB) Ping() error {
+	return db.raw.Ping()
+}
+
+// Exec executes a query with transparent placeholder and syntax rewriting.
+func (db *DB) Exec(query string, args ...any) (sql.Result, error) {
+	return db.raw.Exec(db.rewrite(query), args...)
+}
+
+// Query executes a query that returns rows, with transparent rewriting.
+func (db *DB) Query(query string, args ...any) (*sql.Rows, error) {
+	return db.raw.Query(db.rewrite(query), args...)
+}
+
+// QueryRow executes a query that returns at most one row, with transparent rewriting.
+func (db *DB) QueryRow(query string, args ...any) *sql.Row {
+	return db.raw.QueryRow(db.rewrite(query), args...)
+}
+
+// Begin starts a transaction, returning a dialect-aware Tx.
+func (db *DB) Begin() (*Tx, error) {
+	tx, err := db.raw.Begin()
+	if err != nil {
+		return nil, err
+	}
+	return &Tx{raw: tx, dialect: db.dialect}, nil
+}
+
+// ExecReturningID executes an INSERT and returns the auto-generated id.
+//   - SQLite: uses LastInsertId()
+//   - PostgreSQL: appends RETURNING id and uses QueryRow().Scan()
+func (db *DB) ExecReturningID(query string, args ...any) (int64, error) {
+	q := db.rewrite(query)
+	if db.dialect == DialectPostgres {
+		q = ensureReturningID(q)
+		var id int64
+		if err := db.raw.QueryRow(q, args...).Scan(&id); err != nil {
+			return 0, err
+		}
+		return id, nil
+	}
+	res, err := db.raw.Exec(q, args...)
+	if err != nil {
+		return 0, err
+	}
+	return res.LastInsertId()
+}
+
+// Tx wraps *sql.Tx with dialect awareness.
+type Tx struct {
+	raw     *sql.Tx
+	dialect Dialect
+}
+
+// Exec executes a query inside the transaction with transparent rewriting.
+func (tx *Tx) Exec(query string, args ...any) (sql.Result, error) {
+	return tx.raw.Exec(rewriteQuery(tx.dialect, query), args...)
+}
+
+// Query executes a query that returns rows inside the transaction.
+func (tx *Tx) Query(query string, args ...any) (*sql.Rows, error) {
+	return tx.raw.Query(rewriteQuery(tx.dialect, query), args...)
+}
+
+// QueryRow executes a query that returns at most one row inside the transaction.
+func (tx *Tx) QueryRow(query string, args ...any) *sql.Row {
+	return tx.raw.QueryRow(rewriteQuery(tx.dialect, query), args...)
+}
+
+// Commit commits the transaction.
+func (tx *Tx) Commit() error { return tx.raw.Commit() }
+
+// Rollback aborts the transaction.
+func (tx *Tx) Rollback() error { return tx.raw.Rollback() }
+
+// ExecReturningID executes an INSERT inside the transaction and returns the id.
+func (tx *Tx) ExecReturningID(query string, args ...any) (int64, error) {
+	q := rewriteQuery(tx.dialect, query)
+	if tx.dialect == DialectPostgres {
+		q = ensureReturningID(q)
+		var id int64
+		if err := tx.raw.QueryRow(q, args...).Scan(&id); err != nil {
+			return 0, err
+		}
+		return id, nil
+	}
+	res, err := tx.raw.Exec(q, args...)
+	if err != nil {
+		return 0, err
+	}
+	return res.LastInsertId()
+}
+
+func (db *DB) rewrite(query string) string {
+	return rewriteQuery(db.dialect, query)
+}
+
+func rewriteQuery(dialect Dialect, query string) string {
+	if dialect != DialectPostgres {
+		return query
+	}
+	query = rewriteUserIdentifier(query)
+	query = rewriteInsertOrIgnore(query)
+	query = rewritePlaceholders(query)
+	return query
+}
+
+func rewriteUserIdentifier(query string) string {
+	var buf strings.Builder
+	buf.Grow(len(query) + 16)
+	i := 0
+	for i < len(query) {
+		if end, ok := skipSQLProtectedSegment(query, i); ok {
+			buf.WriteString(query[i:end])
+			i = end
+			continue
+		}
+
+		ch := query[i]
+		if isIdentifierChar(ch) {
+			j := i + 1
+			for j < len(query) && isIdentifierChar(query[j]) {
+				j++
+			}
+			tok := query[i:j]
+			if strings.EqualFold(tok, "user") {
+				buf.WriteString(`"user"`)
+			} else {
+				buf.WriteString(tok)
+			}
+			i = j
+			continue
+		}
+
+		buf.WriteByte(ch)
+		i++
+	}
+	return buf.String()
+}
+
+func isIdentifierChar(ch byte) bool {
+	if ch >= 'a' && ch <= 'z' {
+		return true
+	}
+	if ch >= 'A' && ch <= 'Z' {
+		return true
+	}
+	if ch >= '0' && ch <= '9' {
+		return true
+	}
+	return ch == '_'
+}
+
+func rewriteInsertOrIgnore(query string) string {
+	start, end, ok := findKeywordSequenceOutside(query, []string{"INSERT", "OR", "IGNORE", "INTO"}, 0)
+	if !ok {
+		return query
+	}
+
+	rewritten := query[:start] + "INSERT INTO" + query[end:]
+	rewritten = strings.TrimRight(rewritten, "; \t\n")
+
+	insertIntoEnd := start + len("INSERT INTO")
+	if _, _, hasOnConflict := findKeywordSequenceOutside(rewritten, []string{"ON", "CONFLICT"}, insertIntoEnd); hasOnConflict {
+		return rewritten
+	}
+
+	if retStart, _, hasReturning := findKeywordSequenceOutside(rewritten, []string{"RETURNING"}, insertIntoEnd); hasReturning {
+		prefix := strings.TrimRight(rewritten[:retStart], " \t\n")
+		suffix := strings.TrimLeft(rewritten[retStart:], " \t\n")
+		return prefix + " ON CONFLICT DO NOTHING " + suffix
+	}
+
+	return rewritten + " ON CONFLICT DO NOTHING"
+}
+
+func rewritePlaceholders(query string) string {
+	var buf strings.Builder
+	buf.Grow(len(query) + 16)
+	n := 1
+	for i := 0; i < len(query); i++ {
+		if end, ok := skipSQLProtectedSegment(query, i); ok {
+			buf.WriteString(query[i:end])
+			i = end - 1
+			continue
+		}
+
+		ch := query[i]
+		if ch == '?' {
+			buf.WriteByte('$')
+			buf.WriteString(strconv.Itoa(n))
+			n++
+			continue
+		}
+		buf.WriteByte(ch)
+	}
+	return buf.String()
+}
+
+func ensureReturningID(query string) string {
+	trimmed := strings.TrimRight(query, "; \t\n")
+	if _, _, ok := findKeywordSequenceOutside(trimmed, []string{"RETURNING"}, 0); ok {
+		return trimmed
+	}
+	return trimmed + " RETURNING id"
+}
+
+func findKeywordSequenceOutside(query string, keywords []string, from int) (int, int, bool) {
+	if len(keywords) == 0 {
+		return 0, 0, false
+	}
+	if from < 0 {
+		from = 0
+	}
+	if from >= len(query) {
+		return 0, 0, false
+	}
+
+	matched := 0
+	seqStart := -1
+
+	for i := from; i < len(query); {
+		if end, ok := skipSQLProtectedSegment(query, i); ok {
+			i = end
+			continue
+		}
+
+		ch := query[i]
+		if isIdentifierChar(ch) {
+			j := i + 1
+			for j < len(query) && isIdentifierChar(query[j]) {
+				j++
+			}
+			tok := query[i:j]
+
+			if strings.EqualFold(tok, keywords[matched]) {
+				if matched == 0 {
+					seqStart = i
+				}
+				matched++
+				if matched == len(keywords) {
+					return seqStart, j, true
+				}
+			} else if strings.EqualFold(tok, keywords[0]) {
+				seqStart = i
+				matched = 1
+			} else {
+				matched = 0
+				seqStart = -1
+			}
+
+			i = j
+			continue
+		}
+
+		if !isSQLSpace(ch) {
+			matched = 0
+			seqStart = -1
+		}
+		i++
+	}
+
+	return 0, 0, false
+}
+
+func skipSQLProtectedSegment(query string, i int) (int, bool) {
+	if i < 0 || i >= len(query) {
+		return 0, false
+	}
+
+	switch query[i] {
+	case '\'':
+		return skipSingleQuotedLiteral(query, i), true
+	case '"':
+		return skipDoubleQuotedIdentifier(query, i), true
+	case '-':
+		if i+1 < len(query) && query[i+1] == '-' {
+			return skipLineComment(query, i), true
+		}
+	case '/':
+		if i+1 < len(query) && query[i+1] == '*' {
+			return skipBlockComment(query, i), true
+		}
+	case '$':
+		if end, ok := skipDollarQuotedLiteral(query, i); ok {
+			return end, true
+		}
+	}
+
+	return 0, false
+}
+
+func skipSingleQuotedLiteral(query string, i int) int {
+	for j := i + 1; j < len(query); j++ {
+		if query[j] != '\'' {
+			continue
+		}
+		if j+1 < len(query) && query[j+1] == '\'' {
+			j++
+			continue
+		}
+		return j + 1
+	}
+	return len(query)
+}
+
+func skipDoubleQuotedIdentifier(query string, i int) int {
+	for j := i + 1; j < len(query); j++ {
+		if query[j] != '"' {
+			continue
+		}
+		if j+1 < len(query) && query[j+1] == '"' {
+			j++
+			continue
+		}
+		return j + 1
+	}
+	return len(query)
+}
+
+func skipLineComment(query string, i int) int {
+	for j := i + 2; j < len(query); j++ {
+		if query[j] == '\n' {
+			return j
+		}
+	}
+	return len(query)
+}
+
+func skipBlockComment(query string, i int) int {
+	depth := 1
+	for j := i + 2; j < len(query)-1; j++ {
+		if query[j] == '/' && query[j+1] == '*' {
+			depth++
+			j++
+			continue
+		}
+		if query[j] == '*' && query[j+1] == '/' {
+			depth--
+			j++
+			if depth == 0 {
+				return j + 1
+			}
+		}
+	}
+	return len(query)
+}
+
+func skipDollarQuotedLiteral(query string, i int) (int, bool) {
+	if i < 0 || i >= len(query) || query[i] != '$' {
+		return 0, false
+	}
+
+	if i+1 >= len(query) {
+		return 0, false
+	}
+
+	var endTag int
+	if query[i+1] == '$' {
+		endTag = i + 1
+	} else {
+		if !isDollarTagStart(query[i+1]) {
+			return 0, false
+		}
+		j := i + 2
+		for j < len(query) && isDollarTagChar(query[j]) {
+			j++
+		}
+		if j >= len(query) || query[j] != '$' {
+			return 0, false
+		}
+		endTag = j
+	}
+
+	tag := query[i : endTag+1]
+	if closeIdx := strings.Index(query[endTag+1:], tag); closeIdx >= 0 {
+		return endTag + 1 + closeIdx + len(tag), true
+	}
+	return len(query), true
+}
+
+func isDollarTagStart(ch byte) bool {
+	return ch == '_' || (ch >= 'a' && ch <= 'z') || (ch >= 'A' && ch <= 'Z')
+}
+
+func isDollarTagChar(ch byte) bool {
+	if isDollarTagStart(ch) {
+		return true
+	}
+	return ch >= '0' && ch <= '9'
+}
+
+func isSQLSpace(ch byte) bool {
+	switch ch {
+	case ' ', '\t', '\n', '\r', '\f':
+		return true
+	default:
+		return false
+	}
+}
@@ -0,0 +1,116 @@
+package store
+
+import "testing"
+
+func TestRewritePlaceholdersSkipsProtectedSegments(t *testing.T) {
+	q := `SELECT ?, '?', "id?", $$body ? $$, $tag$X?$tag$, col -- comment ?
+FROM t /* block ? */ WHERE id = ?`
+	got := rewritePlaceholders(q)
+	want := `SELECT $1, '?', "id?", $$body ? $$, $tag$X?$tag$, col -- comment ?
+FROM t /* block ? */ WHERE id = $2`
+	if got != want {
+		t.Fatalf("unexpected rewrite\nwant: %s\ngot:  %s", want, got)
+	}
+}
+
+func TestRewriteInsertOrIgnoreBasic(t *testing.T) {
+	q := `INSERT OR IGNORE INTO user_group_user(user_group_id, user_id, created_time) VALUES(?, ?, ?)`
+	got := rewriteInsertOrIgnore(q)
+	want := `INSERT INTO user_group_user(user_group_id, user_id, created_time) VALUES(?, ?, ?) ON CONFLICT DO NOTHING`
+	if got != want {
+		t.Fatalf("unexpected rewrite\nwant: %s\ngot:  %s", want, got)
+	}
+}
+
+func TestRewriteInsertOrIgnoreBeforeReturning(t *testing.T) {
+	q := `INSERT OR IGNORE INTO x(a) VALUES(?) RETURNING id`
+	got := rewriteInsertOrIgnore(q)
+	want := `INSERT INTO x(a) VALUES(?) ON CONFLICT DO NOTHING RETURNING id`
+	if got != want {
+		t.Fatalf("unexpected rewrite\nwant: %s\ngot:  %s", want, got)
+	}
+}
+
+func TestRewriteInsertOrIgnoreNotDuplicatingOnConflict(t *testing.T) {
+	q := `INSERT OR IGNORE INTO x(a) VALUES(?) ON CONFLICT(a) DO UPDATE SET a=excluded.a`
+	got := rewriteInsertOrIgnore(q)
+	want := `INSERT INTO x(a) VALUES(?) ON CONFLICT(a) DO UPDATE SET a=excluded.a`
+	if got != want {
+		t.Fatalf("unexpected rewrite\nwant: %s\ngot:  %s", want, got)
+	}
+}
+
+func TestEnsureReturningID(t *testing.T) {
+	if got := ensureReturningID(`INSERT INTO x(a) VALUES($1)`); got != `INSERT INTO x(a) VALUES($1) RETURNING id` {
+		t.Fatalf("missing RETURNING append: %s", got)
+	}
+	if got := ensureReturningID(`INSERT INTO x(a) VALUES($1) RETURNING other_id`); got != `INSERT INTO x(a) VALUES($1) RETURNING other_id` {
+		t.Fatalf("RETURNING should not be duplicated: %s", got)
+	}
+}
+
+func TestRewriteUserIdentifierSafety(t *testing.T) {
+	q := `SELECT user, user_id, 'user', "user", note FROM user -- user
+WHERE owner='user'`
+	got := rewriteUserIdentifier(q)
+	want := `SELECT "user", user_id, 'user', "user", note FROM "user" -- user
+WHERE owner='user'`
+	if got != want {
+		t.Fatalf("unexpected rewrite\nwant: %s\ngot:  %s", want, got)
+	}
+}
+
+func TestRewriteQueryPostgresPipeline(t *testing.T) {
+	q := `INSERT OR IGNORE INTO user(name, note) VALUES(?, '?')`
+	got := rewriteQuery(DialectPostgres, q)
+	want := `INSERT INTO "user"(name, note) VALUES($1, '?') ON CONFLICT DO NOTHING`
+	if got != want {
+		t.Fatalf("unexpected rewrite\nwant: %s\ngot:  %s", want, got)
+	}
+}
+
+func TestRewriteInsertOrIgnoreSkipsStringLiteral(t *testing.T) {
+	q := `SELECT 'INSERT OR IGNORE INTO t(a) VALUES(?)' AS q`
+	got := rewriteInsertOrIgnore(q)
+	if got != q {
+		t.Fatalf("string literal should stay unchanged\nwant: %s\ngot:  %s", q, got)
+	}
+}
+
+func TestRewriteInsertOrIgnoreSkipsCommentedKeyword(t *testing.T) {
+	q := `-- INSERT OR IGNORE INTO ignored(a) VALUES(?)
+INSERT OR IGNORE INTO real_t(a) VALUES(?)`
+	got := rewriteInsertOrIgnore(q)
+	want := `-- INSERT OR IGNORE INTO ignored(a) VALUES(?)
+INSERT INTO real_t(a) VALUES(?) ON CONFLICT DO NOTHING`
+	if got != want {
+		t.Fatalf("unexpected rewrite\nwant: %s\ngot:  %s", want, got)
+	}
+}
+
+func TestRewritePlaceholdersSkipsNestedBlockComment(t *testing.T) {
+	q := `SELECT ? /* outer ? /* inner ? */ still_outer ? */ FROM t WHERE id = ?`
+	got := rewritePlaceholders(q)
+	want := `SELECT $1 /* outer ? /* inner ? */ still_outer ? */ FROM t WHERE id = $2`
+	if got != want {
+		t.Fatalf("unexpected rewrite\nwant: %s\ngot:  %s", want, got)
+	}
+}
+
+func TestRewritePlaceholdersSkipsUnterminatedBlockComment(t *testing.T) {
+	q := `SELECT ? /* unterminated ? comment`
+	got := rewritePlaceholders(q)
+	want := `SELECT $1 /* unterminated ? comment`
+	if got != want {
+		t.Fatalf("unexpected rewrite\nwant: %s\ngot:  %s", want, got)
+	}
+}
+
+func TestRewriteUserIdentifierSkipsDollarQuotedAndComment(t *testing.T) {
+	q := `SELECT user, $$user ?$$ AS body, col FROM user /* user */ -- user`
+	got := rewriteUserIdentifier(q)
+	want := `SELECT "user", $$user ?$$ AS body, col FROM "user" /* user */ -- user`
+	if got != want {
+		t.Fatalf("unexpected rewrite\nwant: %s\ngot:  %s", want, got)
+	}
+}
@@ -1,601 +0,0 @@
-// Package model defines GORM model structs for all database tables,
-// providing a single source of truth for the schema that works
-// transparently with both SQLite and PostgreSQL.
-package model
-
-import "database/sql"
-
-// ─── Core Business Tables ────────────────────────────────────────────
-
-// User maps to the "user" table. PostgreSQL treats "user" as a reserved
-// word, so TableName() is required for correct quoting.
-type User struct {
-	ID            int64         `gorm:"primaryKey;autoIncrement"`
-	User          string        `gorm:"column:user;type:varchar(100);not null"`
-	Pwd           string        `gorm:"type:varchar(100);not null"`
-	RoleID        int           `gorm:"column:role_id;not null"`
-	ExpTime       int64         `gorm:"column:exp_time;not null"`
-	Flow          int64         `gorm:"not null"`
-	InFlow        int64         `gorm:"column:in_flow;not null;default:0"`
-	OutFlow       int64         `gorm:"column:out_flow;not null;default:0"`
-	FlowResetTime int64         `gorm:"column:flow_reset_time;not null"`
-	Num           int           `gorm:"not null"`
-	CreatedTime   int64         `gorm:"column:created_time;not null"`
-	UpdatedTime   sql.NullInt64 `gorm:"column:updated_time"`
-	Status        int           `gorm:"not null"`
-}
-
-func (User) TableName() string { return "user" }
-
-// Forward maps to the "forward" table.
-type Forward struct {
-	ID          int64         `gorm:"primaryKey;autoIncrement"`
-	UserID      int64         `gorm:"column:user_id;not null"`
-	UserName    string        `gorm:"column:user_name;type:varchar(100);not null"`
-	Name        string        `gorm:"type:varchar(100);not null"`
-	TunnelID    int64         `gorm:"column:tunnel_id;not null"`
-	RemoteAddr  string        `gorm:"column:remote_addr;type:text;not null"`
-	Strategy    string        `gorm:"type:varchar(100);not null;default:'fifo'"`
-	InFlow      int64         `gorm:"not null;default:0"`
-	OutFlow     int64         `gorm:"column:out_flow;not null;default:0"`
-	CreatedTime int64         `gorm:"column:created_time;not null"`
-	UpdatedTime int64         `gorm:"column:updated_time;not null"`
-	Status      int           `gorm:"not null"`
-	Inx         int           `gorm:"not null;default:0"`
-	SpeedID     sql.NullInt64 `gorm:"column:speed_id"`
-}
-
-func (Forward) TableName() string { return "forward" }
-
-type ForwardPort struct {
-	ID        int64          `gorm:"primaryKey;autoIncrement"`
-	ForwardID int64          `gorm:"column:forward_id;not null"`
-	NodeID    int64          `gorm:"column:node_id;not null"`
-	Port      int            `gorm:"not null"`
-	InIP      sql.NullString `gorm:"column:in_ip;type:text"`
-}
-
-func (ForwardPort) TableName() string { return "forward_port" }
-
-type Node struct {
-	ID            int64          `gorm:"primaryKey;autoIncrement"`
-	Name          string         `gorm:"type:varchar(100);not null"`
-	Secret        string         `gorm:"type:varchar(100);not null"`
-	ServerIP      string         `gorm:"column:server_ip;type:varchar(100);not null"`
-	ServerIPV4    sql.NullString `gorm:"column:server_ip_v4;type:varchar(100)"`
-	ServerIPV6    sql.NullString `gorm:"column:server_ip_v6;type:varchar(100)"`
-	ExtraIPs      sql.NullString `gorm:"column:extra_ips;type:text"`
-	Port          string         `gorm:"type:text;not null"`
-	InterfaceName sql.NullString `gorm:"column:interface_name;type:varchar(200)"`
-	Version       sql.NullString `gorm:"type:varchar(100)"`
-	HTTP          int            `gorm:"column:http;not null;default:0"`
-	TLS           int            `gorm:"column:tls;not null;default:0"`
-	Socks         int            `gorm:"not null;default:0"`
-	CreatedTime   int64          `gorm:"column:created_time;not null"`
-	UpdatedTime   sql.NullInt64  `gorm:"column:updated_time"`
-	Status        int            `gorm:"not null"`
-	TCPListenAddr string         `gorm:"column:tcp_listen_addr;type:varchar(100);not null;default:'[::]'"`
-	UDPListenAddr string         `gorm:"column:udp_listen_addr;type:varchar(100);not null;default:'[::]'"`
-	Inx           int            `gorm:"not null;default:0"`
-	IsRemote      int            `gorm:"column:is_remote;default:0"`
-	RemoteURL     sql.NullString `gorm:"column:remote_url;type:text"`
-	RemoteToken   sql.NullString `gorm:"column:remote_token;type:text"`
-	RemoteConfig  sql.NullString `gorm:"column:remote_config;type:text"`
-}
-
-func (Node) TableName() string { return "node" }
-
-type SpeedLimit struct {
-	ID          int64          `gorm:"primaryKey;autoIncrement"`
-	Name        string         `gorm:"type:varchar(100);not null"`
-	Speed       int            `gorm:"not null"`
-	TunnelID    sql.NullInt64  `gorm:"column:tunnel_id"`
-	TunnelName  sql.NullString `gorm:"column:tunnel_name;type:varchar(100)"`
-	CreatedTime int64          `gorm:"column:created_time;not null"`
-	UpdatedTime sql.NullInt64  `gorm:"column:updated_time"`
-	Status      int            `gorm:"not null"`
-}
-
-func (SpeedLimit) TableName() string { return "speed_limit" }
-
-type StatisticsFlow struct {
-	ID          int64  `gorm:"primaryKey;autoIncrement" json:"id"`
-	UserID      int64  `gorm:"column:user_id;not null" json:"userId"`
-	Flow        int64  `gorm:"not null" json:"flow"`
-	TotalFlow   int64  `gorm:"column:total_flow;not null" json:"totalFlow"`
-	Time        string `gorm:"type:varchar(100);not null" json:"time"`
-	CreatedTime int64  `gorm:"column:created_time;not null" json:"-"`
-}
-
-func (StatisticsFlow) TableName() string { return "statistics_flow" }
-
-type Tunnel struct {
-	ID           int64          `gorm:"primaryKey;autoIncrement"`
-	Name         string         `gorm:"type:varchar(100);not null"`
-	TrafficRatio float64        `gorm:"column:traffic_ratio;not null;default:1.0"`
-	Type         int            `gorm:"not null"`
-	Protocol     string         `gorm:"type:varchar(10);not null;default:'tls'"`
-	Flow         int64          `gorm:"not null"`
-	CreatedTime  int64          `gorm:"column:created_time;not null"`
-	UpdatedTime  int64          `gorm:"column:updated_time;not null"`
-	Status       int            `gorm:"not null"`
-	InIP         sql.NullString `gorm:"column:in_ip;type:text"`
-	Inx          int            `gorm:"not null;default:0"`
-	IPPreference string         `gorm:"column:ip_preference;type:varchar(10);not null;default:''"`
-}
-
-func (Tunnel) TableName() string { return "tunnel" }
-
-type ChainTunnel struct {
-	ID        int64          `gorm:"primaryKey;autoIncrement"`
-	TunnelID  int64          `gorm:"column:tunnel_id;not null"`
-	ChainType string         `gorm:"column:chain_type;type:varchar(10);not null"`
-	NodeID    int64          `gorm:"column:node_id;not null"`
-	Port      sql.NullInt64  `gorm:"column:port"`
-	Strategy  sql.NullString `gorm:"type:varchar(10)"`
-	Inx       sql.NullInt64  `gorm:"column:inx"`
-	Protocol  sql.NullString `gorm:"type:varchar(10)"`
-	ConnectIP sql.NullString `gorm:"column:connect_ip;type:varchar(45)"`
-}
-
-func (ChainTunnel) TableName() string { return "chain_tunnel" }
-
-type UserTunnel struct {
-	ID            int64         `gorm:"primaryKey;autoIncrement"`
-	UserID        int64         `gorm:"column:user_id;not null;uniqueIndex:idx_user_tunnel_unique"`
-	TunnelID      int64         `gorm:"column:tunnel_id;not null;uniqueIndex:idx_user_tunnel_unique"`
-	SpeedID       sql.NullInt64 `gorm:"column:speed_id"`
-	Num           int           `gorm:"not null"`
-	Flow          int64         `gorm:"not null"`
-	InFlow        int64         `gorm:"column:in_flow;not null;default:0"`
-	OutFlow       int64         `gorm:"column:out_flow;not null;default:0"`
-	FlowResetTime int64         `gorm:"column:flow_reset_time;not null"`
-	ExpTime       int64         `gorm:"column:exp_time;not null"`
-	Status        int           `gorm:"not null"`
-}
-
-func (UserTunnel) TableName() string { return "user_tunnel" }
-
-type TunnelGroup struct {
-	ID          int64  `gorm:"primaryKey;autoIncrement"`
-	Name        string `gorm:"type:varchar(100);not null;uniqueIndex:idx_tunnel_group_name"`
-	CreatedTime int64  `gorm:"column:created_time;not null"`
-	UpdatedTime int64  `gorm:"column:updated_time;not null"`
-	Status      int    `gorm:"not null"`
-}
-
-func (TunnelGroup) TableName() string { return "tunnel_group" }
-
-type UserGroup struct {
-	ID          int64  `gorm:"primaryKey;autoIncrement"`
-	Name        string `gorm:"type:varchar(100);not null;uniqueIndex:idx_user_group_name"`
-	CreatedTime int64  `gorm:"column:created_time;not null"`
-	UpdatedTime int64  `gorm:"column:updated_time;not null"`
-	Status      int    `gorm:"not null"`
-}
-
-func (UserGroup) TableName() string { return "user_group" }
-
-type TunnelGroupTunnel struct {
-	ID            int64 `gorm:"primaryKey;autoIncrement"`
-	TunnelGroupID int64 `gorm:"column:tunnel_group_id;not null;uniqueIndex:idx_tunnel_group_tunnel_unique"`
-	TunnelID      int64 `gorm:"column:tunnel_id;not null;uniqueIndex:idx_tunnel_group_tunnel_unique"`
-	CreatedTime   int64 `gorm:"column:created_time;not null"`
-}
-
-func (TunnelGroupTunnel) TableName() string { return "tunnel_group_tunnel" }
-
-type UserGroupUser struct {
-	ID          int64 `gorm:"primaryKey;autoIncrement"`
-	UserGroupID int64 `gorm:"column:user_group_id;not null;uniqueIndex:idx_user_group_user_unique"`
-	UserID      int64 `gorm:"column:user_id;not null;uniqueIndex:idx_user_group_user_unique"`
-	CreatedTime int64 `gorm:"column:created_time;not null"`
-}
-
-func (UserGroupUser) TableName() string { return "user_group_user" }
-
-type GroupPermission struct {
-	ID            int64 `gorm:"primaryKey;autoIncrement"`
-	UserGroupID   int64 `gorm:"column:user_group_id;not null;uniqueIndex:idx_group_permission_unique"`
-	TunnelGroupID int64 `gorm:"column:tunnel_group_id;not null;uniqueIndex:idx_group_permission_unique"`
-	CreatedTime   int64 `gorm:"column:created_time;not null"`
-}
-
-func (GroupPermission) TableName() string { return "group_permission" }
-
-type GroupPermissionGrant struct {
-	ID             int64 `gorm:"primaryKey;autoIncrement"`
-	UserGroupID    int64 `gorm:"column:user_group_id;not null;uniqueIndex:idx_group_permission_grant_unique"`
-	TunnelGroupID  int64 `gorm:"column:tunnel_group_id;not null;uniqueIndex:idx_group_permission_grant_unique"`
-	UserTunnelID   int64 `gorm:"column:user_tunnel_id;not null;uniqueIndex:idx_group_permission_grant_unique"`
-	CreatedByGroup int   `gorm:"column:created_by_group;not null;default:0"`
-	CreatedTime    int64 `gorm:"column:created_time;not null"`
-}
-
-func (GroupPermissionGrant) TableName() string { return "group_permission_grant" }
-
-type ViteConfig struct {
-	ID    int64  `gorm:"primaryKey;autoIncrement" json:"id"`
-	Name  string `gorm:"type:varchar(200);not null;uniqueIndex" json:"name"`
-	Value string `gorm:"type:text;not null" json:"value"`
-	Time  int64  `gorm:"not null" json:"time"`
-}
-
-func (ViteConfig) TableName() string { return "vite_config" }
-
-type Announcement struct {
-	ID          int64         `gorm:"primaryKey;autoIncrement" json:"id"`
-	Content     string        `gorm:"type:text;not null" json:"content"`
-	Enabled     int           `gorm:"not null;default:1" json:"enabled"`
-	CreatedTime int64         `gorm:"column:created_time;not null" json:"created_time"`
-	UpdatedTime sql.NullInt64 `gorm:"column:updated_time" json:"updated_time,omitempty"`
-}
-
-func (Announcement) TableName() string { return "announcement" }
-
-type SchemaVersion struct {
-	Version int `gorm:"not null;default:0"`
-}
-
-func (SchemaVersion) TableName() string { return "schema_version" }
-
-type PeerShare struct {
-	ID             int64  `gorm:"primaryKey;autoIncrement" json:"id"`
-	Name           string `gorm:"type:text;not null" json:"name"`
-	NodeID         int64  `gorm:"column:node_id;not null" json:"nodeId"`
-	Token          string `gorm:"type:text;not null;uniqueIndex" json:"token"`
-	MaxBandwidth   int64  `gorm:"column:max_bandwidth;default:0" json:"maxBandwidth"`
-	ExpiryTime     int64  `gorm:"column:expiry_time;default:0" json:"expiryTime"`
-	PortRangeStart int    `gorm:"column:port_range_start;default:0" json:"portRangeStart"`
-	PortRangeEnd   int    `gorm:"column:port_range_end;default:0" json:"portRangeEnd"`
-	CurrentFlow    int64  `gorm:"column:current_flow;default:0" json:"currentFlow"`
-	IsActive       int    `gorm:"column:is_active;default:1" json:"isActive"`
-	CreatedTime    int64  `gorm:"column:created_time;not null" json:"createdTime"`
-	UpdatedTime    int64  `gorm:"column:updated_time;not null" json:"updatedTime"`
-	AllowedDomains string `gorm:"column:allowed_domains;type:text;default:''" json:"allowedDomains"`
-	AllowedIPs     string `gorm:"column:allowed_ips;type:text;default:''" json:"allowedIps"`
-}
-
-func (PeerShare) TableName() string { return "peer_share" }
-
-type PeerShareRuntime struct {
-	ID            int64  `gorm:"primaryKey;autoIncrement"`
-	ShareID       int64  `gorm:"column:share_id;not null;index:idx_peer_share_runtime_share_node_status"`
-	NodeID        int64  `gorm:"column:node_id;not null;index:idx_peer_share_runtime_share_node_status"`
-	ReservationID string `gorm:"column:reservation_id;type:text;not null;uniqueIndex"`
-	ResourceKey   string `gorm:"column:resource_key;type:text;not null;uniqueIndex"`
-	BindingID     string `gorm:"column:binding_id;type:text;not null;default:'';index:idx_peer_share_runtime_binding_id"`
-	Role          string `gorm:"type:text;not null;default:''"`
-	ChainName     string `gorm:"column:chain_name;type:text;not null;default:''"`
-	ServiceName   string `gorm:"column:service_name;type:text;not null;default:''"`
-	Protocol      string `gorm:"type:text;not null;default:'tls'"`
-	Strategy      string `gorm:"type:text;not null;default:'round'"`
-	Port          int    `gorm:"not null;default:0"`
-	Target        string `gorm:"type:text;not null;default:''"`
-	Applied       int    `gorm:"not null;default:0"`
-	Status        int    `gorm:"not null;default:1;index:idx_peer_share_runtime_share_node_status"`
-	CreatedTime   int64  `gorm:"column:created_time;not null"`
-	UpdatedTime   int64  `gorm:"column:updated_time;not null"`
-}
-
-func (PeerShareRuntime) TableName() string { return "peer_share_runtime" }
-
-type FederationTunnelBinding struct {
-	ID              int64  `gorm:"primaryKey;autoIncrement"`
-	TunnelID        int64  `gorm:"column:tunnel_id;not null;uniqueIndex:idx_federation_tunnel_binding_unique;index:idx_federation_tunnel_binding_tunnel"`
-	NodeID          int64  `gorm:"column:node_id;not null;uniqueIndex:idx_federation_tunnel_binding_unique"`
-	ChainType       int    `gorm:"column:chain_type;not null;uniqueIndex:idx_federation_tunnel_binding_unique"`
-	HopInx          int    `gorm:"column:hop_inx;not null;default:0;uniqueIndex:idx_federation_tunnel_binding_unique"`
-	RemoteURL       string `gorm:"column:remote_url;type:text;not null"`
-	ResourceKey     string `gorm:"column:resource_key;type:text;not null;uniqueIndex"`
-	RemoteBindingID string `gorm:"column:remote_binding_id;type:text;not null"`
-	AllocatedPort   int    `gorm:"column:allocated_port;not null"`
-	Status          int    `gorm:"not null;default:1;index:idx_federation_tunnel_binding_tunnel"`
-	CreatedTime     int64  `gorm:"column:created_time;not null"`
-	UpdatedTime     int64  `gorm:"column:updated_time;not null"`
-}
-
-func (FederationTunnelBinding) TableName() string { return "federation_tunnel_binding" }
-
-// ─── Backup / Import-Export Structs ──────────────────────────────────
-// These are not GORM models; they define the JSON wire format for the
-// backup/restore API and MUST keep their existing json tags unchanged.
-
-// BackupData represents the full backup structure.
-type BackupData struct {
-	Version      string              `json:"version"`
-	ExportedAt   int64               `json:"exportedAt"`
-	Users        []UserBackup        `json:"users,omitempty"`
-	Nodes        []NodeBackup        `json:"nodes,omitempty"`
-	Tunnels      []TunnelBackup      `json:"tunnels,omitempty"`
-	Forwards     []ForwardBackup     `json:"forwards,omitempty"`
-	UserTunnels  []UserTunnelBackup  `json:"userTunnels,omitempty"`
-	SpeedLimits  []SpeedLimitBackup  `json:"speedLimits,omitempty"`
-	TunnelGroups []TunnelGroupBackup `json:"tunnelGroups,omitempty"`
-	UserGroups   []UserGroupBackup   `json:"userGroups,omitempty"`
-	Permissions  []PermissionBackup  `json:"permissions,omitempty"`
-	Configs      map[string]string   `json:"configs,omitempty"`
-}
-
-type UserBackup struct {
-	ID            int64  `json:"id"`
-	User          string `json:"user"`
-	Pwd           string `json:"pwd"`
-	RoleID        int    `json:"roleId"`
-	ExpTime       int64  `json:"expTime"`
-	Flow          int64  `json:"flow"`
-	InFlow        int64  `json:"inFlow"`
-	OutFlow       int64  `json:"outFlow"`
-	FlowResetTime int64  `json:"flowResetTime"`
-	Num           int    `json:"num"`
-	CreatedTime   int64  `json:"createdTime"`
-	UpdatedTime   int64  `json:"updatedTime,omitempty"`
-	Status        int    `json:"status"`
-}
-
-type NodeBackup struct {
-	ID            int64  `json:"id"`
-	Name          string `json:"name"`
-	Secret        string `json:"secret"`
-	ServerIP      string `json:"serverIp"`
-	ServerIPv4    string `json:"serverIpV4,omitempty"`
-	ServerIPv6    string `json:"serverIpV6,omitempty"`
-	ExtraIPs      string `json:"extraIPs,omitempty"`
-	Port          string `json:"port"`
-	InterfaceName string `json:"interfaceName,omitempty"`
-	Version       string `json:"version,omitempty"`
-	HTTP          int    `json:"http"`
-	TLS           int    `json:"tls"`
-	Socks         int    `json:"socks"`
-	CreatedTime   int64  `json:"createdTime"`
-	UpdatedTime   int64  `json:"updatedTime,omitempty"`
-	Status        int    `json:"status"`
-	TCPListenAddr string `json:"tcpListenAddr"`
-	UDPListenAddr string `json:"udpListenAddr"`
-	Inx           int    `json:"inx"`
-	IsRemote      int    `json:"isRemote"`
-	RemoteURL     string `json:"remoteUrl,omitempty"`
-	RemoteToken   string `json:"remoteToken,omitempty"`
-	RemoteConfig  string `json:"remoteConfig,omitempty"`
-}
-
-type TunnelBackup struct {
-	ID           int64               `json:"id"`
-	Name         string              `json:"name"`
-	TrafficRatio float64             `json:"trafficRatio"`
-	Type         int                 `json:"type"`
-	Protocol     string              `json:"protocol"`
-	Flow         int64               `json:"flow"`
-	CreatedTime  int64               `json:"createdTime"`
-	UpdatedTime  int64               `json:"updatedTime"`
-	Status       int                 `json:"status"`
-	InIP         string              `json:"inIp,omitempty"`
-	Inx          int                 `json:"inx"`
-	IPPreference string              `json:"ipPreference,omitempty"`
-	ChainTunnels []ChainTunnelBackup `json:"chainTunnels,omitempty"`
-}
-
-type ChainTunnelBackup struct {
-	ID        int64  `json:"id"`
-	TunnelID  int64  `json:"tunnelId"`
-	ChainType string `json:"chainType"`
-	NodeID    int64  `json:"nodeId"`
-	Port      int    `json:"port,omitempty"`
-	Strategy  string `json:"strategy,omitempty"`
-	Inx       int    `json:"inx,omitempty"`
-	Protocol  string `json:"protocol,omitempty"`
-}
-
-type ForwardBackup struct {
-	ID           int64                `json:"id"`
-	UserID       int64                `json:"userId"`
-	UserName     string               `json:"userName"`
-	Name         string               `json:"name"`
-	TunnelID     int64                `json:"tunnelId"`
-	RemoteAddr   string               `json:"remoteAddr"`
-	Strategy     string               `json:"strategy"`
-	InFlow       int64                `json:"inFlow"`
-	OutFlow      int64                `json:"outFlow"`
-	CreatedTime  int64                `json:"createdTime"`
-	UpdatedTime  int64                `json:"updatedTime"`
-	Status       int                  `json:"status"`
-	Inx          int                  `json:"inx"`
-	SpeedID      *int64               `json:"speedId,omitempty"`
-	ForwardPorts *[]ForwardPortBackup `json:"forwardPorts,omitempty"`
-}
-
-type ForwardPortBackup struct {
-	NodeID int64 `json:"nodeId"`
-	Port   int   `json:"port"`
-}
-
-type UserTunnelBackup struct {
-	ID            int64 `json:"id"`
-	UserID        int64 `json:"userId"`
-	TunnelID      int64 `json:"tunnelId"`
-	SpeedID       int64 `json:"speedId,omitempty"`
-	Num           int   `json:"num"`
-	Flow          int64 `json:"flow"`
-	InFlow        int64 `json:"inFlow"`
-	OutFlow       int64 `json:"outFlow"`
-	FlowResetTime int64 `json:"flowResetTime"`
-	ExpTime       int64 `json:"expTime"`
-	Status        int   `json:"status"`
-}
-
-type SpeedLimitBackup struct {
-	ID          int64  `json:"id"`
-	Name        string `json:"name"`
-	Speed       int64  `json:"speed"`
-	TunnelID    *int64 `json:"tunnelId,omitempty"`
-	TunnelName  string `json:"tunnelName,omitempty"`
-	CreatedTime int64  `json:"createdTime"`
-	UpdatedTime int64  `json:"updatedTime,omitempty"`
-	Status      int    `json:"status"`
-}
-
-type TunnelGroupBackup struct {
-	ID          int64   `json:"id"`
-	Name        string  `json:"name"`
-	CreatedTime int64   `json:"createdTime"`
-	UpdatedTime int64   `json:"updatedTime"`
-	Status      int     `json:"status"`
-	Tunnels     []int64 `json:"tunnels,omitempty"`
-}
-
-type UserGroupBackup struct {
-	ID          int64   `json:"id"`
-	Name        string  `json:"name"`
-	CreatedTime int64   `json:"createdTime"`
-	UpdatedTime int64   `json:"updatedTime"`
-	Status      int     `json:"status"`
-	Users       []int64 `json:"users,omitempty"`
-}
-
-type PermissionBackup struct {
-	ID             int64                   `json:"id"`
-	UserGroupID    int64                   `json:"userGroupId"`
-	TunnelGroupID  int64                   `json:"tunnelGroupId"`
-	CreatedTime    int64                   `json:"createdTime"`
-	CreatedByGroup int                     `json:"createdByGroup"`
-	Grants         []PermissionGrantBackup `json:"grants,omitempty"`
-}
-
-type PermissionGrantBackup struct {
-	ID             int64 `json:"id"`
-	UserGroupID    int64 `json:"userGroupId"`
-	TunnelGroupID  int64 `json:"tunnelGroupId"`
-	UserTunnelID   int64 `json:"userTunnelId"`
-	CreatedTime    int64 `json:"createdTime"`
-	CreatedByGroup int   `json:"createdByGroup"`
-}
-
-// ImportResult contains the result of an import operation.
-type ImportResult struct {
-	UsersImported        int         `json:"usersImported"`
-	NodesImported        int         `json:"nodesImported"`
-	TunnelsImported      int         `json:"tunnelsImported"`
-	ForwardsImported     int         `json:"forwardsImported"`
-	UserTunnelsImported  int         `json:"userTunnelsImported"`
-	SpeedLimitsImported  int         `json:"speedLimitsImported"`
-	TunnelGroupsImported int         `json:"tunnelGroupsImported"`
-	UserGroupsImported   int         `json:"userGroupsImported"`
-	PermissionsImported  int         `json:"permissionsImported"`
-	ConfigsImported      int         `json:"configsImported"`
-	AutoBackup           *BackupData `json:"autoBackup,omitempty"`
-}
-
-// ─── View Structs (used by Repository, not GORM models) ─────────────
-// These are used for JOIN query results that don't map 1:1 to a table.
-
-// ForwardRecord is a minimal forward view used by control plane and flow policy.
-type ForwardRecord struct {
-	ID         int64
-	UserID     int64
-	UserName   string
-	Name       string
-	TunnelID   int64
-	RemoteAddr string
-	Strategy   string
-	Status     int
-	SpeedID    sql.NullInt64
-}
-
-// TunnelRecord is a minimal tunnel view used by control plane.
-type TunnelRecord struct {
-	ID           int64
-	Type         int
-	Status       int
-	Flow         int64
-	TrafficRatio float64
-}
-
-// ForwardPortRecord is a forward port mapping used by control plane.
-type ForwardPortRecord struct {
-	NodeID int64
-	Port   int
-	InIP   string
-}
-
-// NodeRecord is a node view used by control plane.
-type NodeRecord struct {
-	ID            int64
-	Name          string
-	ServerIP      string
-	ServerIPv4    string
-	ServerIPv6    string
-	ExtraIPs      string
-	Status        int
-	PortRange     string
-	TCPListenAddr string
-	UDPListenAddr string
-	InterfaceName string
-	IsRemote      int
-	RemoteURL     string
-	RemoteToken   string
-	RemoteConfig  string
-}
-
-type ChainNodeRecord struct {
-	ChainType int
-	Inx       int64
-	NodeID    int64
-	Port      int
-	NodeName  string
-	Protocol  string
-	Strategy  string
-	ConnectIP string
-}
-
-type UserTunnelLimiterInfo struct {
-	UserTunnelID int64
-	LimiterID    *int64
-	Speed        *int
-}
-
-// UserFlowSnapshot holds a user's current flow counters (used by stats job).
-type UserFlowSnapshot struct {
-	UserID  int64
-	InFlow  int64
-	OutFlow int64
-}
-
-// ExpiredUserTunnel holds minimal info for an expired user_tunnel row.
-type ExpiredUserTunnel struct {
-	ID       int64
-	UserID   int64
-	TunnelID int64
-}
-
-// UserTunnelDetail is a joined view of user_tunnel + tunnel + speed_limit.
-type UserTunnelDetail struct {
-	ID            int64
-	UserID        int64
-	TunnelID      int64
-	TunnelName    string
-	TunnelFlow    int
-	Flow          int64
-	InFlow        int64
-	OutFlow       int64
-	Num           int
-	FlowResetTime int64
-	ExpTime       int64
-	SpeedID       sql.NullInt64
-	SpeedLimit    sql.NullString
-	Speed         sql.NullInt64
-}
-
-// UserForwardDetail is a joined view of forward + tunnel.
-type UserForwardDetail struct {
-	ID         int64
-	Name       string
-	TunnelID   int64
-	TunnelName string
-	InIP       string
-	InPort     sql.NullInt64
-	RemoteAddr string
-	InFlow     int64
-	OutFlow    int64
-	Status     int
-	CreatedAt  int64
-}
@@ -0,0 +1,9 @@
+package postgres
+
+import _ "embed"
+
+//go:embed sql/schema.sql
+var EmbeddedSchema string
+
+//go:embed sql/data.sql
+var EmbeddedSeedData string
@@ -0,0 +1,18 @@
+INSERT INTO "user" (id, "user", pwd, role_id, exp_time, flow, in_flow, out_flow, flow_reset_time, num, created_time, updated_time, status)
+VALUES (1, 'admin_user', '3c85cdebade1c51cf64ca9f3c09d182d', 0, 2727251700000, 99999, 0, 0, 1, 99999, 1748914865000, 1754011744252, 1)
+ON CONFLICT DO NOTHING;
+
+INSERT INTO vite_config (id, name, value, time)
+VALUES (1, 'app_name', 'flux', 1755147963000)
+ON CONFLICT DO NOTHING;
+
+DO $$
+BEGIN
+    IF to_regclass('public.user_id_seq') IS NOT NULL THEN
+        PERFORM setval('user_id_seq', (SELECT COALESCE(MAX(id), 0) FROM "user"));
+    END IF;
+    IF to_regclass('public.vite_config_id_seq') IS NOT NULL THEN
+        PERFORM setval('vite_config_id_seq', (SELECT COALESCE(MAX(id), 0) FROM vite_config));
+    END IF;
+END
+$$;
@@ -0,0 +1,242 @@
+CREATE TABLE IF NOT EXISTS forward (
+  id SERIAL PRIMARY KEY,
+  user_id INTEGER NOT NULL,
+  user_name VARCHAR(100) NOT NULL,
+  name VARCHAR(100) NOT NULL,
+  tunnel_id INTEGER NOT NULL,
+  remote_addr TEXT NOT NULL,
+  strategy VARCHAR(100) NOT NULL DEFAULT 'fifo',
+  in_flow BIGINT NOT NULL DEFAULT 0,
+  out_flow BIGINT NOT NULL DEFAULT 0,
+  created_time BIGINT NOT NULL,
+  updated_time BIGINT NOT NULL,
+  status INTEGER NOT NULL,
+  inx INTEGER NOT NULL DEFAULT 0
+);
+
+CREATE TABLE IF NOT EXISTS forward_port (
+  id SERIAL PRIMARY KEY,
+  forward_id INTEGER NOT NULL,
+  node_id INTEGER NOT NULL,
+  port INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS node (
+  id SERIAL PRIMARY KEY,
+  name VARCHAR(100) NOT NULL,
+  secret VARCHAR(100) NOT NULL,
+  server_ip VARCHAR(100) NOT NULL,
+  server_ip_v4 VARCHAR(100),
+  server_ip_v6 VARCHAR(100),
+  port TEXT NOT NULL,
+  interface_name VARCHAR(200),
+  version VARCHAR(100),
+  http INTEGER NOT NULL DEFAULT 0,
+  tls INTEGER NOT NULL DEFAULT 0,
+  socks INTEGER NOT NULL DEFAULT 0,
+  created_time BIGINT NOT NULL,
+  updated_time BIGINT,
+  status INTEGER NOT NULL,
+  tcp_listen_addr VARCHAR(100) NOT NULL DEFAULT '[::]',
+  udp_listen_addr VARCHAR(100) NOT NULL DEFAULT '[::]',
+  inx INTEGER NOT NULL DEFAULT 0,
+  is_remote INTEGER DEFAULT 0,
+  remote_url TEXT,
+  remote_token TEXT,
+  remote_config TEXT
+);
+
+CREATE TABLE IF NOT EXISTS speed_limit (
+  id SERIAL PRIMARY KEY,
+  name VARCHAR(100) NOT NULL,
+  speed INTEGER NOT NULL,
+  tunnel_id INTEGER NOT NULL,
+  tunnel_name VARCHAR(100) NOT NULL,
+  created_time BIGINT NOT NULL,
+  updated_time BIGINT,
+  status INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS statistics_flow (
+  id SERIAL PRIMARY KEY,
+  user_id INTEGER NOT NULL,
+  flow BIGINT NOT NULL,
+  total_flow BIGINT NOT NULL,
+  time VARCHAR(100) NOT NULL,
+  created_time BIGINT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS tunnel (
+  id SERIAL PRIMARY KEY,
+  name VARCHAR(100) NOT NULL,
+  traffic_ratio DOUBLE PRECISION NOT NULL DEFAULT 1.0,
+  type INTEGER NOT NULL,
+  protocol VARCHAR(10) NOT NULL DEFAULT 'tls',
+  flow BIGINT NOT NULL,
+  created_time BIGINT NOT NULL,
+  updated_time BIGINT NOT NULL,
+  status INTEGER NOT NULL,
+  in_ip TEXT,
+  inx INTEGER NOT NULL DEFAULT 0,
+  ip_preference VARCHAR(10) NOT NULL DEFAULT ''
+);
+
+CREATE TABLE IF NOT EXISTS chain_tunnel (
+    id SERIAL PRIMARY KEY,
+    tunnel_id INTEGER NOT NULL,
+    chain_type VARCHAR(10) NOT NULL,
+    node_id INTEGER NOT NULL,
+    port INTEGER,
+    strategy VARCHAR(10),
+    inx INTEGER,
+    protocol VARCHAR(10)
+);
+
+CREATE TABLE IF NOT EXISTS "user" (
+  id SERIAL PRIMARY KEY,
+  "user" VARCHAR(100) NOT NULL,
+  pwd VARCHAR(100) NOT NULL,
+  role_id INTEGER NOT NULL,
+  exp_time BIGINT NOT NULL,
+  flow BIGINT NOT NULL,
+  in_flow BIGINT NOT NULL DEFAULT 0,
+  out_flow BIGINT NOT NULL DEFAULT 0,
+  flow_reset_time BIGINT NOT NULL,
+  num INTEGER NOT NULL,
+  created_time BIGINT NOT NULL,
+  updated_time BIGINT,
+  status INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS user_tunnel (
+  id SERIAL PRIMARY KEY,
+  user_id INTEGER NOT NULL,
+  tunnel_id INTEGER NOT NULL,
+  speed_id INTEGER,
+  num INTEGER NOT NULL,
+  flow BIGINT NOT NULL,
+  in_flow BIGINT NOT NULL DEFAULT 0,
+  out_flow BIGINT NOT NULL DEFAULT 0,
+  flow_reset_time BIGINT NOT NULL,
+  exp_time BIGINT NOT NULL,
+  status INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS tunnel_group (
+  id SERIAL PRIMARY KEY,
+  name VARCHAR(100) NOT NULL,
+  created_time BIGINT NOT NULL,
+  updated_time BIGINT NOT NULL,
+  status INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS user_group (
+  id SERIAL PRIMARY KEY,
+  name VARCHAR(100) NOT NULL,
+  created_time BIGINT NOT NULL,
+  updated_time BIGINT NOT NULL,
+  status INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS tunnel_group_tunnel (
+  id SERIAL PRIMARY KEY,
+  tunnel_group_id INTEGER NOT NULL,
+  tunnel_id INTEGER NOT NULL,
+  created_time BIGINT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS user_group_user (
+  id SERIAL PRIMARY KEY,
+  user_group_id INTEGER NOT NULL,
+  user_id INTEGER NOT NULL,
+  created_time BIGINT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS group_permission (
+  id SERIAL PRIMARY KEY,
+  user_group_id INTEGER NOT NULL,
+  tunnel_group_id INTEGER NOT NULL,
+  created_time BIGINT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS group_permission_grant (
+  id SERIAL PRIMARY KEY,
+  user_group_id INTEGER NOT NULL,
+  tunnel_group_id INTEGER NOT NULL,
+  user_tunnel_id INTEGER NOT NULL,
+  created_by_group INTEGER NOT NULL DEFAULT 0,
+  created_time BIGINT NOT NULL
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_tunnel_group_name ON tunnel_group(name);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_user_group_name ON user_group(name);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_tunnel_group_tunnel_unique ON tunnel_group_tunnel(tunnel_group_id, tunnel_id);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_user_group_user_unique ON user_group_user(user_group_id, user_id);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_group_permission_unique ON group_permission(user_group_id, tunnel_group_id);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_group_permission_grant_unique ON group_permission_grant(user_group_id, tunnel_group_id, user_tunnel_id);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_user_tunnel_unique ON user_tunnel(user_id, tunnel_id);
+
+CREATE TABLE IF NOT EXISTS vite_config (
+  id SERIAL PRIMARY KEY,
+  name VARCHAR(200) NOT NULL UNIQUE,
+  value VARCHAR(200) NOT NULL,
+  time BIGINT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS peer_share (
+    id SERIAL PRIMARY KEY,
+    name TEXT NOT NULL,
+    node_id INTEGER NOT NULL,
+    token TEXT NOT NULL UNIQUE,
+    max_bandwidth INTEGER DEFAULT 0,
+    expiry_time BIGINT DEFAULT 0,
+    port_range_start INTEGER DEFAULT 0,
+    port_range_end INTEGER DEFAULT 0,
+    current_flow BIGINT DEFAULT 0,
+    is_active INTEGER DEFAULT 1,
+    created_time BIGINT NOT NULL,
+    updated_time BIGINT NOT NULL,
+    allowed_domains TEXT DEFAULT '',
+    allowed_ips TEXT DEFAULT ''
+);
+
+CREATE TABLE IF NOT EXISTS peer_share_runtime (
+    id SERIAL PRIMARY KEY,
+    share_id INTEGER NOT NULL,
+    node_id INTEGER NOT NULL,
+    reservation_id TEXT NOT NULL UNIQUE,
+    resource_key TEXT NOT NULL UNIQUE,
+    binding_id TEXT NOT NULL DEFAULT '',
+    role TEXT NOT NULL DEFAULT '',
+    chain_name TEXT NOT NULL DEFAULT '',
+    service_name TEXT NOT NULL DEFAULT '',
+    protocol TEXT NOT NULL DEFAULT 'tls',
+    strategy TEXT NOT NULL DEFAULT 'round',
+    port INTEGER NOT NULL DEFAULT 0,
+    target TEXT NOT NULL DEFAULT '',
+    applied INTEGER NOT NULL DEFAULT 0,
+    status INTEGER NOT NULL DEFAULT 1,
+    created_time BIGINT NOT NULL,
+    updated_time BIGINT NOT NULL
+);
+
+CREATE INDEX IF NOT EXISTS idx_peer_share_runtime_share_node_status ON peer_share_runtime(share_id, node_id, status);
+CREATE INDEX IF NOT EXISTS idx_peer_share_runtime_binding_id ON peer_share_runtime(binding_id);
+
+CREATE TABLE IF NOT EXISTS federation_tunnel_binding (
+    id SERIAL PRIMARY KEY,
+    tunnel_id INTEGER NOT NULL,
+    node_id INTEGER NOT NULL,
+    chain_type INTEGER NOT NULL,
+    hop_inx INTEGER NOT NULL DEFAULT 0,
+    remote_url TEXT NOT NULL,
+    resource_key TEXT NOT NULL UNIQUE,
+    remote_binding_id TEXT NOT NULL,
+    allocated_port INTEGER NOT NULL,
+    status INTEGER NOT NULL DEFAULT 1,
+    created_time BIGINT NOT NULL,
+    updated_time BIGINT NOT NULL
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_federation_tunnel_binding_unique ON federation_tunnel_binding(tunnel_id, node_id, chain_type, hop_inx);
+CREATE INDEX IF NOT EXISTS idx_federation_tunnel_binding_tunnel ON federation_tunnel_binding(tunnel_id, status);
@@ -1,354 +0,0 @@
-package repo
-
-import (
-	"database/sql"
-	"errors"
-	"fmt"
-	"strconv"
-	"strings"
-
-	"gorm.io/gorm"
-
-	"go-backend/internal/store/model"
-)
-
-func (r *Repository) UserTunnelExistsByUserAndTunnel(userID, tunnelID int64) (bool, error) {
-	if r == nil || r.db == nil {
-		return false, errors.New("repository not initialized")
-	}
-	var count int64
-	err := r.db.Model(&model.UserTunnel{}).
-		Where("user_id = ? AND tunnel_id = ? AND status = 1", userID, tunnelID).
-		Count(&count).Error
-	if err != nil {
-		return false, err
-	}
-	return count > 0, nil
-}
-
-func (r *Repository) ListForwardsByTunnel(tunnelID int64) ([]model.ForwardRecord, error) {
-	if r == nil || r.db == nil {
-		return nil, errors.New("repository not initialized")
-	}
-	var forwards []model.Forward
-	err := r.db.Where("tunnel_id = ?", tunnelID).Order("id ASC").Find(&forwards).Error
-	if err != nil {
-		return nil, err
-	}
-	rows := make([]model.ForwardRecord, 0, len(forwards))
-	for _, f := range forwards {
-		rows = append(rows, model.ForwardRecord{
-			ID:         f.ID,
-			UserID:     f.UserID,
-			UserName:   f.UserName,
-			Name:       f.Name,
-			TunnelID:   f.TunnelID,
-			RemoteAddr: f.RemoteAddr,
-			Strategy:   f.Strategy,
-			Status:     f.Status,
-			SpeedID:    f.SpeedID,
-		})
-	}
-	for i := range rows {
-		if strings.TrimSpace(rows[i].Strategy) == "" {
-			rows[i].Strategy = "fifo"
-		}
-	}
-	return rows, nil
-}
-
-func (r *Repository) ListActiveTunnelIDsByNode(nodeID int64) ([]int64, error) {
-	if r == nil || r.db == nil {
-		return nil, errors.New("repository not initialized")
-	}
-	var ids []int64
-	err := r.db.Model(&model.ChainTunnel{}).
-		Joins("JOIN tunnel ON tunnel.id = chain_tunnel.tunnel_id").
-		Where("chain_tunnel.node_id = ? AND tunnel.status = 1", nodeID).
-		Select("DISTINCT chain_tunnel.tunnel_id").
-		Order("chain_tunnel.tunnel_id ASC").
-		Pluck("chain_tunnel.tunnel_id", &ids).Error
-	if err != nil {
-		return nil, err
-	}
-	return ids, nil
-}
-
-func (r *Repository) ListActiveForwardIDsByNode(nodeID int64) ([]int64, error) {
-	if r == nil || r.db == nil {
-		return nil, errors.New("repository not initialized")
-	}
-	var ids []int64
-	err := r.db.Model(&model.ForwardPort{}).
-		Joins("JOIN forward ON forward.id = forward_port.forward_id").
-		Where("forward_port.node_id = ? AND forward.status = 1", nodeID).
-		Select("DISTINCT forward_port.forward_id").
-		Order("forward_port.forward_id ASC").
-		Pluck("forward_port.forward_id", &ids).Error
-	if err != nil {
-		return nil, err
-	}
-	return ids, nil
-}
-
-func (r *Repository) ListForwardPorts(forwardID int64) ([]model.ForwardPortRecord, error) {
-	if r == nil || r.db == nil {
-		return nil, errors.New("repository not initialized")
-	}
-	var ports []model.ForwardPort
-	err := r.db.Where("forward_id = ?", forwardID).Order("id ASC").Find(&ports).Error
-	if err != nil {
-		return nil, err
-	}
-	rows := make([]model.ForwardPortRecord, 0, len(ports))
-	for _, p := range ports {
-		inIP := ""
-		if p.InIP.Valid {
-			inIP = p.InIP.String
-		}
-		rows = append(rows, model.ForwardPortRecord{NodeID: p.NodeID, Port: p.Port, InIP: inIP})
-	}
-	return rows, nil
-}
-
-func (r *Repository) GetTunnelOutProtocol(tunnelID int64) (string, error) {
-	if r == nil || r.db == nil {
-		return "", errors.New("repository not initialized")
-	}
-	var ct model.ChainTunnel
-	err := r.db.Select("protocol").
-		Where("tunnel_id = ? AND chain_type = ?", tunnelID, "3").
-		Order("id ASC").
-		Take(&ct).Error
-	if err != nil {
-		if errors.Is(err, gorm.ErrRecordNotFound) {
-			return "", nil
-		}
-		return "", err
-	}
-	if ct.Protocol.Valid {
-		return ct.Protocol.String, nil
-	}
-	return "", nil
-}
-
-func (r *Repository) GetNodeRecord(nodeID int64) (*model.NodeRecord, error) {
-	if r == nil || r.db == nil {
-		return nil, errors.New("repository not initialized")
-	}
-	var n model.Node
-	err := r.db.Where("id = ?", nodeID).First(&n).Error
-	if errors.Is(err, gorm.ErrRecordNotFound) {
-		return nil, nil
-	}
-	if err != nil {
-		return nil, err
-	}
-	return nodeRecordFromModel(&n), nil
-}
-
-func (r *Repository) GetNodeRecordTx(tx *gorm.DB, nodeID int64) (*model.NodeRecord, error) {
-	if tx == nil {
-		return nil, errors.New("database unavailable")
-	}
-	var n model.Node
-	err := tx.Where("id = ?", nodeID).First(&n).Error
-	if errors.Is(err, gorm.ErrRecordNotFound) {
-		return nil, nil
-	}
-	if err != nil {
-		return nil, err
-	}
-	return nodeRecordFromModel(&n), nil
-}
-
-func nodeRecordFromModel(n *model.Node) *model.NodeRecord {
-	if n == nil {
-		return nil
-	}
-	rec := &model.NodeRecord{
-		ID:            n.ID,
-		Name:          n.Name,
-		ServerIP:      n.ServerIP,
-		Status:        n.Status,
-		PortRange:     n.Port,
-		TCPListenAddr: n.TCPListenAddr, UDPListenAddr: n.UDPListenAddr,
-		IsRemote: n.IsRemote,
-	}
-	if n.ServerIPV4.Valid {
-		rec.ServerIPv4 = strings.TrimSpace(n.ServerIPV4.String)
-	}
-	if n.ServerIPV6.Valid {
-		rec.ServerIPv6 = strings.TrimSpace(n.ServerIPV6.String)
-	}
-	if n.ExtraIPs.Valid {
-		rec.ExtraIPs = strings.TrimSpace(n.ExtraIPs.String)
-	}
-	if n.InterfaceName.Valid {
-		rec.InterfaceName = strings.TrimSpace(n.InterfaceName.String)
-	}
-	if n.RemoteURL.Valid {
-		rec.RemoteURL = strings.TrimSpace(n.RemoteURL.String)
-	}
-	if n.RemoteToken.Valid {
-		rec.RemoteToken = strings.TrimSpace(n.RemoteToken.String)
-	}
-	if n.RemoteConfig.Valid {
-		rec.RemoteConfig = strings.TrimSpace(n.RemoteConfig.String)
-	}
-	if rec.TCPListenAddr == "" {
-		rec.TCPListenAddr = "[::]"
-	}
-	if rec.UDPListenAddr == "" {
-		rec.UDPListenAddr = "[::]"
-	}
-	if strings.TrimSpace(rec.Name) == "" {
-		rec.Name = fmt.Sprintf("node_%d", rec.ID)
-	}
-	return rec
-}
-
-func (r *Repository) ResolveUserTunnelAndLimiter(userID, tunnelID int64) (*model.UserTunnelLimiterInfo, error) {
-	if r == nil || r.db == nil {
-		return nil, errors.New("repository not initialized")
-	}
-	type row struct {
-		UserTunnelID int64         `gorm:"column:user_tunnel_id"`
-		LimiterID    sql.NullInt64 `gorm:"column:limiter_id"`
-		Speed        sql.NullInt64 `gorm:"column:speed"`
-	}
-	var rec row
-	err := r.db.Model(&model.UserTunnel{}).
-		Select("user_tunnel.id AS user_tunnel_id, speed_limit.id AS limiter_id, speed_limit.speed AS speed").
-		Joins("LEFT JOIN speed_limit ON speed_limit.id = user_tunnel.speed_id").
-		Where("user_tunnel.user_id = ? AND user_tunnel.tunnel_id = ?", userID, tunnelID).
-		Order("user_tunnel.id ASC").
-		Limit(1).
-		Take(&rec).Error
-	if err != nil {
-		if errors.Is(err, gorm.ErrRecordNotFound) {
-			return &model.UserTunnelLimiterInfo{}, nil
-		}
-		return nil, err
-	}
-	info := &model.UserTunnelLimiterInfo{UserTunnelID: rec.UserTunnelID}
-	if rec.LimiterID.Valid && rec.LimiterID.Int64 > 0 {
-		v := rec.LimiterID.Int64
-		info.LimiterID = &v
-		s := int(rec.Speed.Int64)
-		info.Speed = &s
-	}
-	return info, nil
-}
-
-func (r *Repository) ListUserTunnelIDs(userID, tunnelID int64) ([]int64, error) {
-	if r == nil || r.db == nil {
-		return nil, errors.New("repository not initialized")
-	}
-	var ids []int64
-	err := r.db.Model(&model.UserTunnel{}).
-		Where("user_id = ? AND tunnel_id = ?", userID, tunnelID).
-		Order("id ASC").Pluck("id", &ids).Error
-	if err != nil {
-		return nil, err
-	}
-	return ids, nil
-}
-
-func (r *Repository) ListUserTunnelIDsByUser(userID int64) ([]int64, error) {
-	if r == nil || r.db == nil {
-		return nil, errors.New("repository not initialized")
-	}
-	var ids []int64
-	err := r.db.Model(&model.UserTunnel{}).
-		Where("user_id = ?", userID).
-		Order("id ASC").Pluck("id", &ids).Error
-	if err != nil {
-		return nil, err
-	}
-	return ids, nil
-}
-
-func (r *Repository) GetTunnelName(tunnelID int64) (string, error) {
-	if r == nil || r.db == nil {
-		return "", errors.New("repository not initialized")
-	}
-	var name string
-	err := r.db.Model(&model.Tunnel{}).Where("id = ?", tunnelID).Pluck("name", &name).Error
-	if err != nil {
-		if errors.Is(err, gorm.ErrRecordNotFound) {
-			return "", nil
-		}
-		return "", err
-	}
-	return name, nil
-}
-
-func (r *Repository) ListChainNodesForTunnel(tunnelID int64) ([]model.ChainNodeRecord, error) {
-	if r == nil || r.db == nil {
-		return nil, errors.New("repository not initialized")
-	}
-	type row struct {
-		ChainType string
-		Inx       sql.NullInt64
-		NodeID    int64
-		Port      sql.NullInt64
-		Name      sql.NullString
-		Protocol  sql.NullString
-		Strategy  sql.NullString
-		ConnectIP sql.NullString
-	}
-	var rows []row
-	err := r.db.Model(&model.ChainTunnel{}).
-		Select("chain_tunnel.chain_type, chain_tunnel.inx, chain_tunnel.node_id, chain_tunnel.port, node.name, chain_tunnel.protocol, chain_tunnel.strategy, chain_tunnel.connect_ip").
-		Joins("LEFT JOIN node ON node.id = chain_tunnel.node_id").
-		Where("chain_tunnel.tunnel_id = ?", tunnelID).
-		Order("chain_tunnel.chain_type ASC, chain_tunnel.inx ASC, chain_tunnel.id ASC").
-		Find(&rows).Error
-	if err != nil {
-		return nil, err
-	}
-	result := make([]model.ChainNodeRecord, 0, len(rows))
-	for _, row := range rows {
-		chainType := 0
-		if v := strings.TrimSpace(row.ChainType); v != "" {
-			if parsed, parseErr := strconv.Atoi(v); parseErr == nil {
-				chainType = parsed
-			}
-		}
-		inx := int64(0)
-		if row.Inx.Valid {
-			inx = row.Inx.Int64
-		}
-		port := 0
-		if row.Port.Valid {
-			port = int(row.Port.Int64)
-		}
-		item := model.ChainNodeRecord{
-			ChainType: chainType,
-			Inx:       inx,
-			NodeID:    row.NodeID,
-			Port:      port,
-		}
-		if strings.TrimSpace(row.Name.String) == "" {
-			item.NodeName = fmt.Sprintf("node_%d", row.NodeID)
-		} else {
-			item.NodeName = row.Name.String
-		}
-		if strings.TrimSpace(row.Protocol.String) == "" {
-			item.Protocol = "tls"
-		} else {
-			item.Protocol = row.Protocol.String
-		}
-		if strings.TrimSpace(row.Strategy.String) == "" {
-			item.Strategy = "round"
-		} else {
-			item.Strategy = row.Strategy.String
-		}
-		if row.ConnectIP.Valid {
-			item.ConnectIP = row.ConnectIP.String
-		}
-		result = append(result, item)
-	}
-	return result, nil
-}
@@ -1,294 +0,0 @@
-package repo
-
-import (
-	"database/sql"
-	"errors"
-
-	"go-backend/internal/store/model"
-
-	"gorm.io/gorm"
-)
-
-// RemoteNodeRow holds the columns fetched for a remote node listing.
-type RemoteNodeRow struct {
-	ID           int64
-	Name         string
-	RemoteURL    sql.NullString
-	RemoteToken  sql.NullString
-	RemoteConfig sql.NullString
-}
-
-// NodeBasicInfo holds name, server_ip, and status for a node.
-type NodeBasicInfo struct {
-	Name     string
-	ServerIP string
-	Status   int
-}
-
-// FederationBindingRow holds the columns for an active federation tunnel binding.
-type FederationBindingRow struct {
-	ID              int64
-	TunnelID        int64
-	TunnelName      string
-	ChainType       int
-	HopInx          int
-	AllocatedPort   int
-	ResourceKey     string
-	RemoteBindingID string
-	UpdatedTime     int64
-}
-
-type ActiveForwardPortRow struct {
-	ForwardID   int64
-	TunnelID    int64
-	TunnelName  string
-	Port        int
-	UpdatedTime int64
-}
-
-// ListRemoteNodes returns all nodes with is_remote=1, ordered by id desc.
-func (r *Repository) ListRemoteNodes() ([]RemoteNodeRow, error) {
-	if r == nil || r.db == nil {
-		return nil, errors.New("repository not initialized")
-	}
-	var result []RemoteNodeRow
-	err := r.db.Model(&model.Node{}).
-		Select("id, name, remote_url, remote_token, remote_config").
-		Where("is_remote = 1").
-		Order("id DESC").
-		Find(&result).Error
-	if err != nil {
-		return nil, err
-	}
-	if result == nil {
-		result = make([]RemoteNodeRow, 0)
-	}
-	return result, nil
-}
-
-// UpdateNodeRemoteConfig sets the remote_config JSON for a given node.
-func (r *Repository) UpdateNodeRemoteConfig(nodeID int64, configJSON string) error {
-	if r == nil || r.db == nil {
-		return errors.New("repository not initialized")
-	}
-	return r.db.Model(&model.Node{}).Where("id = ?", nodeID).Update("remote_config", configJSON).Error
-}
-
-// ListActiveBindingsForNode returns active federation tunnel bindings for a node.
-func (r *Repository) ListActiveBindingsForNode(nodeID int64) ([]FederationBindingRow, error) {
-	if r == nil || r.db == nil {
-		return nil, errors.New("repository not initialized")
-	}
-	var result []FederationBindingRow
-	err := r.db.Model(&model.FederationTunnelBinding{}).
-		Select("federation_tunnel_binding.id, federation_tunnel_binding.tunnel_id, COALESCE(tunnel.name, '') AS tunnel_name, federation_tunnel_binding.chain_type, federation_tunnel_binding.hop_inx, federation_tunnel_binding.allocated_port, federation_tunnel_binding.resource_key, federation_tunnel_binding.remote_binding_id, federation_tunnel_binding.updated_time").
-		Joins("LEFT JOIN tunnel ON tunnel.id = federation_tunnel_binding.tunnel_id").
-		Where("federation_tunnel_binding.node_id = ? AND federation_tunnel_binding.status = 1", nodeID).
-		Order("federation_tunnel_binding.allocated_port ASC, federation_tunnel_binding.id ASC").
-		Find(&result).Error
-	if err != nil {
-		return nil, err
-	}
-	if result == nil {
-		result = make([]FederationBindingRow, 0)
-	}
-	return result, nil
-}
-
-func (r *Repository) ListActiveForwardPortsForNode(nodeID int64) ([]ActiveForwardPortRow, error) {
-	if r == nil || r.db == nil {
-		return nil, errors.New("repository not initialized")
-	}
-	var result []ActiveForwardPortRow
-	err := r.db.Model(&model.ForwardPort{}).
-		Select("forward_port.forward_id, forward.tunnel_id, COALESCE(tunnel.name, '') AS tunnel_name, forward_port.port, forward.updated_time").
-		Joins("JOIN forward ON forward.id = forward_port.forward_id").
-		Joins("LEFT JOIN tunnel ON tunnel.id = forward.tunnel_id").
-		Where("forward_port.node_id = ? AND forward_port.port > 0", nodeID).
-		Order("forward_port.port ASC, forward_port.id ASC").
-		Find(&result).Error
-	if err != nil {
-		return nil, err
-	}
-	if result == nil {
-		result = make([]ActiveForwardPortRow, 0)
-	}
-	return result, nil
-}
-
-// GetNodeBasicInfo returns the name, server_ip, and status for a given node.
-func (r *Repository) GetNodeBasicInfo(nodeID int64) (*NodeBasicInfo, error) {
-	if r == nil || r.db == nil {
-		return nil, errors.New("repository not initialized")
-	}
-	var n model.Node
-	err := r.db.Select("name", "server_ip", "status").Where("id = ?", nodeID).First(&n).Error
-	if err != nil {
-		return nil, err
-	}
-	return &NodeBasicInfo{Name: n.Name, ServerIP: n.ServerIP, Status: n.Status}, nil
-}
-
-// CreateFederationTunnel creates a tunnel and chain_tunnel entry in a transaction,
-// returning the new tunnel ID.
-func (r *Repository) CreateFederationTunnel(name string, tunnelType int, protocol string, now int64, nodeID int64, remotePort int) (int64, error) {
-	if r == nil || r.db == nil {
-		return 0, errors.New("repository not initialized")
-	}
-	tunnel := model.Tunnel{
-		Name:        name,
-		Type:        tunnelType,
-		Protocol:    protocol,
-		Flow:        0,
-		CreatedTime: now,
-		UpdatedTime: now,
-		Status:      1,
-		InIP:        sql.NullString{String: "", Valid: false},
-	}
-	err := r.db.Transaction(func(tx *gorm.DB) error {
-		if err := tx.Create(&tunnel).Error; err != nil {
-			return err
-		}
-		ct := model.ChainTunnel{
-			TunnelID:  tunnel.ID,
-			ChainType: "1",
-			NodeID:    nodeID,
-			Port:      sql.NullInt64{Int64: int64(remotePort), Valid: true},
-			Strategy:  sql.NullString{String: "fifo", Valid: true},
-			Inx:       sql.NullInt64{Int64: 0, Valid: true},
-			Protocol:  sql.NullString{String: protocol, Valid: true},
-		}
-		if err := tx.Create(&ct).Error; err != nil {
-			return err
-		}
-		return nil
-	})
-	if err != nil {
-		return 0, err
-	}
-	return tunnel.ID, nil
-}
-
-// ListUsedPortsOnNode returns all ports in use on a given node from chain_tunnel and forward_port tables.
-func (r *Repository) ListUsedPortsOnNode(nodeID int64) ([]int, error) {
-	if r == nil || r.db == nil {
-		return nil, errors.New("repository not initialized")
-	}
-	used := make(map[int]struct{})
-
-	var chainPorts []int
-	err := r.db.Model(&model.ChainTunnel{}).
-		Where("node_id = ? AND port > 0", nodeID).
-		Pluck("port", &chainPorts).Error
-	if err != nil {
-		return nil, err
-	}
-	for _, p := range chainPorts {
-		if p > 0 {
-			used[p] = struct{}{}
-		}
-	}
-
-	var forwardPorts []int
-	err = r.db.Model(&model.ForwardPort{}).
-		Where("node_id = ? AND port > 0", nodeID).
-		Pluck("port", &forwardPorts).Error
-	if err != nil {
-		return nil, err
-	}
-	for _, p := range forwardPorts {
-		if p > 0 {
-			used[p] = struct{}{}
-		}
-	}
-
-	result := make([]int, 0, len(used))
-	for p := range used {
-		result = append(result, p)
-	}
-	return result, nil
-}
-
-// ListTunnelIDsByNamePrefix returns all tunnel IDs whose name starts with the given prefix.
-func (r *Repository) ListTunnelIDsByNamePrefix(prefix string) ([]int64, error) {
-	if r == nil || r.db == nil {
-		return nil, errors.New("repository not initialized")
-	}
-	var ids []int64
-	err := r.db.Model(&model.Tunnel{}).
-		Where("name LIKE ?", prefix+"%").
-		Order("id ASC").
-		Pluck("id", &ids).Error
-	if err != nil {
-		return nil, err
-	}
-	if ids == nil {
-		ids = make([]int64, 0)
-	}
-	return ids, nil
-}
-
-func (r *Repository) NextIndex(table string) int {
-	if r == nil || r.db == nil {
-		return 0
-	}
-	var modelRef interface{}
-	switch table {
-	case "node":
-		modelRef = &model.Node{}
-	case "tunnel":
-		modelRef = &model.Tunnel{}
-	case "forward":
-		modelRef = &model.Forward{}
-	default:
-		return 0
-	}
-
-	type inxRow struct {
-		Inx int
-	}
-	var row inxRow
-	err := r.db.Model(modelRef).
-		Select("inx").
-		Order("inx ASC, id ASC").
-		Limit(1).
-		Take(&row).Error
-	if errors.Is(err, gorm.ErrRecordNotFound) {
-		return 0
-	}
-	if err != nil {
-		return 0
-	}
-	return row.Inx - 1
-}
-
-// CreateRemoteNode inserts a new remote node.
-func (r *Repository) CreateRemoteNode(name, secret, serverIP, portRange string, now int64, status int, inx int, remoteURL, remoteToken, remoteConfigJSON string) error {
-	if r == nil || r.db == nil {
-		return errors.New("repository not initialized")
-	}
-	node := model.Node{
-		Name:          name,
-		Secret:        secret,
-		ServerIP:      serverIP,
-		ServerIPV4:    sql.NullString{},
-		ServerIPV6:    sql.NullString{},
-		Port:          portRange,
-		InterfaceName: sql.NullString{},
-		Version:       sql.NullString{},
-		HTTP:          0,
-		TLS:           0,
-		Socks:         0,
-		CreatedTime:   now,
-		UpdatedTime:   sql.NullInt64{Int64: now, Valid: true},
-		Status:        status,
-		TCPListenAddr: "[::]",
-		UDPListenAddr: "[::]",
-		Inx:           inx,
-		IsRemote:      1,
-		RemoteURL:     sql.NullString{String: remoteURL, Valid: remoteURL != ""},
-		RemoteToken:   sql.NullString{String: remoteToken, Valid: remoteToken != ""},
-		RemoteConfig:  sql.NullString{String: remoteConfigJSON, Valid: remoteConfigJSON != ""},
-	}
-	return r.db.Create(&node).Error
-}
@@ -1,186 +0,0 @@
-package repo
-
-import (
-	"errors"
-	"strings"
-
-	"gorm.io/gorm"
-
-	"go-backend/internal/store/model"
-)
-
-func (r *Repository) UpdateForwardStatus(forwardID int64, status int, now int64) error {
-	if r == nil || r.db == nil {
-		return errors.New("repository not initialized")
-	}
-	return r.db.Model(&model.Forward{}).Where("id = ?", forwardID).Updates(map[string]interface{}{
-		"status": status, "updated_time": now,
-	}).Error
-}
-
-func (r *Repository) ListActiveForwardsByUser(userID int64) ([]model.ForwardRecord, error) {
-	if r == nil || r.db == nil {
-		return nil, errors.New("repository not initialized")
-	}
-	var forwards []model.Forward
-	err := r.db.Where("user_id = ? AND status = 1", userID).Order("id ASC").Find(&forwards).Error
-	if err != nil {
-		return nil, err
-	}
-	rows := make([]model.ForwardRecord, 0, len(forwards))
-	for _, f := range forwards {
-		rows = append(rows, model.ForwardRecord{
-			ID:         f.ID,
-			UserID:     f.UserID,
-			UserName:   f.UserName,
-			Name:       f.Name,
-			TunnelID:   f.TunnelID,
-			RemoteAddr: f.RemoteAddr,
-			Strategy:   f.Strategy,
-			Status:     f.Status,
-			SpeedID:    f.SpeedID,
-		})
-	}
-	for i := range rows {
-		if strings.TrimSpace(rows[i].Strategy) == "" {
-			rows[i].Strategy = "fifo"
-		}
-	}
-	return rows, nil
-}
-
-func (r *Repository) ListActiveForwardsByUserTunnel(userID, tunnelID int64) ([]model.ForwardRecord, error) {
-	if r == nil || r.db == nil {
-		return nil, errors.New("repository not initialized")
-	}
-	var forwards []model.Forward
-	err := r.db.Where("user_id = ? AND tunnel_id = ? AND status = 1", userID, tunnelID).Order("id ASC").Find(&forwards).Error
-	if err != nil {
-		return nil, err
-	}
-	rows := make([]model.ForwardRecord, 0, len(forwards))
-	for _, f := range forwards {
-		rows = append(rows, model.ForwardRecord{
-			ID:         f.ID,
-			UserID:     f.UserID,
-			UserName:   f.UserName,
-			Name:       f.Name,
-			TunnelID:   f.TunnelID,
-			RemoteAddr: f.RemoteAddr,
-			Strategy:   f.Strategy,
-			Status:     f.Status,
-			SpeedID:    f.SpeedID,
-		})
-	}
-	for i := range rows {
-		if strings.TrimSpace(rows[i].Strategy) == "" {
-			rows[i].Strategy = "fifo"
-		}
-	}
-	return rows, nil
-}
-
-func (r *Repository) GetForwardRecord(forwardID int64) (*model.ForwardRecord, error) {
-	if r == nil || r.db == nil {
-		return nil, errors.New("repository not initialized")
-	}
-	var f model.Forward
-	err := r.db.Where("id = ?", forwardID).First(&f).Error
-	if err != nil {
-		if errors.Is(err, gorm.ErrRecordNotFound) {
-			return nil, nil
-		}
-		return nil, err
-	}
-	fr := model.ForwardRecord{
-		ID:         f.ID,
-		UserID:     f.UserID,
-		UserName:   f.UserName,
-		Name:       f.Name,
-		TunnelID:   f.TunnelID,
-		RemoteAddr: f.RemoteAddr,
-		Strategy:   f.Strategy,
-		Status:     f.Status,
-		SpeedID:    f.SpeedID,
-	}
-	if strings.TrimSpace(fr.Strategy) == "" {
-		fr.Strategy = "fifo"
-	}
-	return &fr, nil
-}
-
-func (r *Repository) GetTunnelRecord(tunnelID int64) (*model.TunnelRecord, error) {
-	if r == nil || r.db == nil {
-		return nil, errors.New("repository not initialized")
-	}
-	var t model.Tunnel
-	err := r.db.Where("id = ?", tunnelID).First(&t).Error
-	if err != nil {
-		if errors.Is(err, gorm.ErrRecordNotFound) {
-			return nil, nil
-		}
-		return nil, err
-	}
-	tr := model.TunnelRecord{
-		ID:           t.ID,
-		Type:         t.Type,
-		Status:       t.Status,
-		Flow:         t.Flow,
-		TrafficRatio: t.TrafficRatio,
-	}
-	if tr.Flow <= 0 {
-		tr.Flow = 1
-	}
-	if tr.TrafficRatio <= 0 {
-		tr.TrafficRatio = 1
-	}
-	return &tr, nil
-}
-
-func (r *Repository) TunnelExists(tunnelID int64) (bool, error) {
-	if r == nil || r.db == nil {
-		return false, errors.New("repository not initialized")
-	}
-	var count int64
-	err := r.db.Model(&model.Tunnel{}).Where("id = ?", tunnelID).Count(&count).Error
-	if err != nil {
-		return false, err
-	}
-	return count > 0, nil
-}
-
-func (r *Repository) ForwardExists(forwardID int64) (bool, error) {
-	if r == nil || r.db == nil {
-		return false, errors.New("repository not initialized")
-	}
-	var count int64
-	err := r.db.Model(&model.Forward{}).Where("id = ?", forwardID).Count(&count).Error
-	if err != nil {
-		return false, err
-	}
-	return count > 0, nil
-}
-
-func (r *Repository) SpeedLimitExists(id int64) (bool, error) {
-	if r == nil || r.db == nil {
-		return false, errors.New("repository not initialized")
-	}
-	var count int64
-	err := r.db.Model(&model.SpeedLimit{}).Where("id = ?", id).Count(&count).Error
-	if err != nil {
-		return false, err
-	}
-	return count > 0, nil
-}
-
-func (r *Repository) GetSpeedLimitSpeed(id int64) (int, error) {
-	if r == nil || r.db == nil {
-		return 0, errors.New("repository not initialized")
-	}
-	var sl model.SpeedLimit
-	err := r.db.Select("speed").Where("id = ?", id).First(&sl).Error
-	if err != nil {
-		return 0, err
-	}
-	return sl.Speed, nil
-}
@@ -1,78 +0,0 @@
-package repo
-
-import (
-	"errors"
-
-	"go-backend/internal/store/model"
-)
-
-// ─── Semantic Group Queries (replacing QueryInt64List/QueryPairs passthrough) ─
-
-// ListUserIDsByUserGroup returns all user IDs belonging to a user group.
-func (r *Repository) ListUserIDsByUserGroup(userGroupID int64) ([]int64, error) {
-	if r == nil || r.db == nil {
-		return nil, errors.New("repository not initialized")
-	}
-	var ids []int64
-	err := r.db.Model(&model.UserGroupUser{}).
-		Where("user_group_id = ?", userGroupID).
-		Pluck("user_id", &ids).Error
-	return ids, err
-}
-
-// ListTunnelIDsByTunnelGroup returns all tunnel IDs belonging to a tunnel group.
-func (r *Repository) ListTunnelIDsByTunnelGroup(tunnelGroupID int64) ([]int64, error) {
-	if r == nil || r.db == nil {
-		return nil, errors.New("repository not initialized")
-	}
-	var ids []int64
-	err := r.db.Model(&model.TunnelGroupTunnel{}).
-		Where("tunnel_group_id = ?", tunnelGroupID).
-		Pluck("tunnel_id", &ids).Error
-	return ids, err
-}
-
-// ListGroupPermissionPairsByUserGroup returns [userGroupID, tunnelGroupID] pairs
-// for all group permissions associated with a user group.
-func (r *Repository) ListGroupPermissionPairsByUserGroup(userGroupID int64) ([][2]int64, error) {
-	if r == nil || r.db == nil {
-		return nil, errors.New("repository not initialized")
-	}
-	var perms []model.GroupPermission
-	err := r.db.Where("user_group_id = ?", userGroupID).Find(&perms).Error
-	if err != nil {
-		return nil, err
-	}
-	result := make([][2]int64, len(perms))
-	for i, p := range perms {
-		result[i] = [2]int64{p.UserGroupID, p.TunnelGroupID}
-	}
-	return result, err
-}
-
-func (r *Repository) GetUserGroupIDsByUserID(userID int64) ([]int64, error) {
-	if r == nil || r.db == nil {
-		return nil, errors.New("repository not initialized")
-	}
-	var ids []int64
-	err := r.db.Model(&model.UserGroupUser{}).
-		Where("user_id = ?", userID).
-		Pluck("user_group_id", &ids).Error
-	return ids, err
-}
-
-func (r *Repository) ListGroupPermissionPairsByTunnelGroup(tunnelGroupID int64) ([][2]int64, error) {
-	if r == nil || r.db == nil {
-		return nil, errors.New("repository not initialized")
-	}
-	var perms []model.GroupPermission
-	err := r.db.Where("tunnel_group_id = ?", tunnelGroupID).Find(&perms).Error
-	if err != nil {
-		return nil, err
-	}
-	result := make([][2]int64, len(perms))
-	for i, p := range perms {
-		result[i] = [2]int64{p.UserGroupID, p.TunnelGroupID}
-	}
-	return result, err
-}
@@ -1,252 +0,0 @@
-package repo
-
-import (
-	"database/sql"
-	"errors"
-	"testing"
-
-	gsqlite "github.com/glebarez/sqlite"
-	"gorm.io/gorm"
-	"gorm.io/gorm/logger"
-)
-
-func TestMigrateSchemaRunsPostgresIDRepairEvenAtCurrentVersion(t *testing.T) {
-	db, err := gorm.Open(gsqlite.Open(":memory:"), &gorm.Config{
-		Logger: logger.Default.LogMode(logger.Silent),
-	})
-	if err != nil {
-		t.Fatalf("open sqlite: %v", err)
-	}
-	t.Cleanup(func() {
-		sqlDB, _ := db.DB()
-		if sqlDB != nil {
-			_ = sqlDB.Close()
-		}
-	})
-
-	if err := db.Exec(`CREATE TABLE schema_version (version INTEGER NOT NULL DEFAULT 0)`).Error; err != nil {
-		t.Fatalf("create schema_version: %v", err)
-	}
-	if err := db.Exec(`INSERT INTO schema_version(version) VALUES(?)`, currentSchemaVersion).Error; err != nil {
-		t.Fatalf("seed schema_version: %v", err)
-	}
-
-	called := 0
-	original := ensurePostgresIDDefaultsFn
-	ensurePostgresIDDefaultsFn = func(db *gorm.DB) error {
-		called++
-		return nil
-	}
-	t.Cleanup(func() {
-		ensurePostgresIDDefaultsFn = original
-	})
-
-	if err := migrateSchema(db); err != nil {
-		t.Fatalf("migrateSchema: %v", err)
-	}
-	if called != 1 {
-		t.Fatalf("expected postgres id repair to run once, got %d", called)
-	}
-}
-
-func TestMigrateSchemaReturnsPostgresIDRepairError(t *testing.T) {
-	db, err := gorm.Open(gsqlite.Open(":memory:"), &gorm.Config{
-		Logger: logger.Default.LogMode(logger.Silent),
-	})
-	if err != nil {
-		t.Fatalf("open sqlite: %v", err)
-	}
-	t.Cleanup(func() {
-		sqlDB, _ := db.DB()
-		if sqlDB != nil {
-			_ = sqlDB.Close()
-		}
-	})
-
-	if err := db.Exec(`CREATE TABLE schema_version (version INTEGER NOT NULL DEFAULT 0)`).Error; err != nil {
-		t.Fatalf("create schema_version: %v", err)
-	}
-	if err := db.Exec(`INSERT INTO schema_version(version) VALUES(?)`, currentSchemaVersion).Error; err != nil {
-		t.Fatalf("seed schema_version: %v", err)
-	}
-
-	wantErr := errors.New("repair failed")
-	original := ensurePostgresIDDefaultsFn
-	ensurePostgresIDDefaultsFn = func(db *gorm.DB) error {
-		return wantErr
-	}
-	t.Cleanup(func() {
-		ensurePostgresIDDefaultsFn = original
-	})
-
-	err = migrateSchema(db)
-	if !errors.Is(err, wantErr) {
-		t.Fatalf("expected error %v, got %v", wantErr, err)
-	}
-}
-
-func TestMigrateSchemaRunsViteConfigValueMigrationForLegacySchema(t *testing.T) {
-	db, err := gorm.Open(gsqlite.Open(":memory:"), &gorm.Config{
-		Logger: logger.Default.LogMode(logger.Silent),
-	})
-	if err != nil {
-		t.Fatalf("open sqlite: %v", err)
-	}
-	t.Cleanup(func() {
-		sqlDB, _ := db.DB()
-		if sqlDB != nil {
-			_ = sqlDB.Close()
-		}
-	})
-
-	if err := db.Exec(`CREATE TABLE schema_version (version INTEGER NOT NULL DEFAULT 0)`).Error; err != nil {
-		t.Fatalf("create schema_version: %v", err)
-	}
-	if err := db.Exec(`INSERT INTO schema_version(version) VALUES(?)`, 2).Error; err != nil {
-		t.Fatalf("seed schema_version: %v", err)
-	}
-
-	originalIDRepair := ensurePostgresIDDefaultsFn
-	ensurePostgresIDDefaultsFn = func(db *gorm.DB) error {
-		return nil
-	}
-	t.Cleanup(func() {
-		ensurePostgresIDDefaultsFn = originalIDRepair
-	})
-
-	called := 0
-	originalMigrate := migrateViteConfigValueColumnTypeFn
-	migrateViteConfigValueColumnTypeFn = func(db *gorm.DB) error {
-		called++
-		return nil
-	}
-	t.Cleanup(func() {
-		migrateViteConfigValueColumnTypeFn = originalMigrate
-	})
-
-	if err := migrateSchema(db); err != nil {
-		t.Fatalf("migrateSchema: %v", err)
-	}
-
-	if called != 1 {
-		t.Fatalf("expected vite_config migration to run once, got %d", called)
-	}
-}
-
-func TestMigrateSchemaReturnsViteConfigMigrationError(t *testing.T) {
-	db, err := gorm.Open(gsqlite.Open(":memory:"), &gorm.Config{
-		Logger: logger.Default.LogMode(logger.Silent),
-	})
-	if err != nil {
-		t.Fatalf("open sqlite: %v", err)
-	}
-	t.Cleanup(func() {
-		sqlDB, _ := db.DB()
-		if sqlDB != nil {
-			_ = sqlDB.Close()
-		}
-	})
-
-	if err := db.Exec(`CREATE TABLE schema_version (version INTEGER NOT NULL DEFAULT 0)`).Error; err != nil {
-		t.Fatalf("create schema_version: %v", err)
-	}
-	if err := db.Exec(`INSERT INTO schema_version(version) VALUES(?)`, 2).Error; err != nil {
-		t.Fatalf("seed schema_version: %v", err)
-	}
-
-	originalIDRepair := ensurePostgresIDDefaultsFn
-	ensurePostgresIDDefaultsFn = func(db *gorm.DB) error {
-		return nil
-	}
-	t.Cleanup(func() {
-		ensurePostgresIDDefaultsFn = originalIDRepair
-	})
-
-	wantErr := errors.New("vite config migration failed")
-	originalMigrate := migrateViteConfigValueColumnTypeFn
-	migrateViteConfigValueColumnTypeFn = func(db *gorm.DB) error {
-		return wantErr
-	}
-	t.Cleanup(func() {
-		migrateViteConfigValueColumnTypeFn = originalMigrate
-	})
-
-	err = migrateSchema(db)
-	if !errors.Is(err, wantErr) {
-		t.Fatalf("expected error %v, got %v", wantErr, err)
-	}
-}
-
-func TestMigrateSchemaClearsSpeedLimitTunnelBinding(t *testing.T) {
-	db, err := gorm.Open(gsqlite.Open(":memory:"), &gorm.Config{
-		Logger: logger.Default.LogMode(logger.Silent),
-	})
-	if err != nil {
-		t.Fatalf("open sqlite: %v", err)
-	}
-	t.Cleanup(func() {
-		sqlDB, _ := db.DB()
-		if sqlDB != nil {
-			_ = sqlDB.Close()
-		}
-	})
-
-	if err := db.Exec(`CREATE TABLE schema_version (version INTEGER NOT NULL DEFAULT 0)`).Error; err != nil {
-		t.Fatalf("create schema_version: %v", err)
-	}
-	if err := db.Exec(`INSERT INTO schema_version(version) VALUES(?)`, 3).Error; err != nil {
-		t.Fatalf("seed schema_version: %v", err)
-	}
-	if err := db.Exec(`
-		CREATE TABLE speed_limit (
-			id INTEGER PRIMARY KEY AUTOINCREMENT,
-			name VARCHAR(100) NOT NULL,
-			speed INTEGER NOT NULL,
-			tunnel_id INTEGER,
-			tunnel_name VARCHAR(100),
-			created_time INTEGER NOT NULL,
-			updated_time INTEGER,
-			status INTEGER NOT NULL
-		)
-	`).Error; err != nil {
-		t.Fatalf("create speed_limit: %v", err)
-	}
-	if err := db.Exec(`
-		INSERT INTO speed_limit(name, speed, tunnel_id, tunnel_name, created_time, updated_time, status)
-		VALUES(?, ?, ?, ?, ?, ?, ?)
-	`, "legacy-speed-limit", 100, 101, "legacy-tunnel", 1, 1, 1).Error; err != nil {
-		t.Fatalf("seed speed_limit: %v", err)
-	}
-
-	originalIDRepair := ensurePostgresIDDefaultsFn
-	ensurePostgresIDDefaultsFn = func(db *gorm.DB) error {
-		return nil
-	}
-	t.Cleanup(func() {
-		ensurePostgresIDDefaultsFn = originalIDRepair
-	})
-
-	if err := migrateSchema(db); err != nil {
-		t.Fatalf("migrateSchema: %v", err)
-	}
-
-	var tunnelID sql.NullInt64
-	var tunnelName sql.NullString
-	if err := db.Raw(`SELECT tunnel_id, tunnel_name FROM speed_limit WHERE name = ?`, "legacy-speed-limit").Row().Scan(&tunnelID, &tunnelName); err != nil {
-		t.Fatalf("query speed_limit: %v", err)
-	}
-	if tunnelID.Valid {
-		t.Fatalf("expected tunnel_id cleared to NULL, got %d", tunnelID.Int64)
-	}
-	if tunnelName.Valid {
-		t.Fatalf("expected tunnel_name cleared to NULL, got %q", tunnelName.String)
-	}
-
-	var schemaVersion int
-	if err := db.Raw(`SELECT version FROM schema_version LIMIT 1`).Row().Scan(&schemaVersion); err != nil {
-		t.Fatalf("query schema_version: %v", err)
-	}
-	if schemaVersion != currentSchemaVersion {
-		t.Fatalf("expected schema version %d, got %d", currentSchemaVersion, schemaVersion)
-	}
-}
@@ -0,0 +1,78 @@
+package sqlite
+
+import (
+	"database/sql"
+	"errors"
+	"testing"
+
+	"go-backend/internal/store"
+
+	_ "modernc.org/sqlite"
+)
+
+func TestMigrateSchemaRunsPostgresIDRepairEvenAtCurrentVersion(t *testing.T) {
+	raw, err := sql.Open("sqlite", ":memory:")
+	if err != nil {
+		t.Fatalf("open sqlite: %v", err)
+	}
+	t.Cleanup(func() {
+		_ = raw.Close()
+	})
+
+	db := store.Wrap(raw, store.DialectPostgres)
+	if _, err := db.Exec(`CREATE TABLE schema_version (version INTEGER NOT NULL DEFAULT 0)`); err != nil {
+		t.Fatalf("create schema_version: %v", err)
+	}
+	if _, err := db.Exec(`INSERT INTO schema_version(version) VALUES(?)`, currentSchemaVersion); err != nil {
+		t.Fatalf("seed schema_version: %v", err)
+	}
+
+	called := 0
+	original := ensurePostgresIDDefaultsFn
+	ensurePostgresIDDefaultsFn = func(db *store.DB) error {
+		called++
+		return nil
+	}
+	t.Cleanup(func() {
+		ensurePostgresIDDefaultsFn = original
+	})
+
+	if err := migrateSchema(db); err != nil {
+		t.Fatalf("migrateSchema: %v", err)
+	}
+	if called != 1 {
+		t.Fatalf("expected postgres id repair to run once, got %d", called)
+	}
+}
+
+func TestMigrateSchemaReturnsPostgresIDRepairError(t *testing.T) {
+	raw, err := sql.Open("sqlite", ":memory:")
+	if err != nil {
+		t.Fatalf("open sqlite: %v", err)
+	}
+	t.Cleanup(func() {
+		_ = raw.Close()
+	})
+
+	db := store.Wrap(raw, store.DialectPostgres)
+	if _, err := db.Exec(`CREATE TABLE schema_version (version INTEGER NOT NULL DEFAULT 0)`); err != nil {
+		t.Fatalf("create schema_version: %v", err)
+	}
+	if _, err := db.Exec(`INSERT INTO schema_version(version) VALUES(?)`, currentSchemaVersion); err != nil {
+		t.Fatalf("seed schema_version: %v", err)
+	}
+
+	wantErr := errors.New("repair failed")
+	original := ensurePostgresIDDefaultsFn
+	ensurePostgresIDDefaultsFn = func(db *store.DB) error {
+		return wantErr
+	}
+	t.Cleanup(func() {
+		ensurePostgresIDDefaultsFn = original
+	})
+
+	err = migrateSchema(db)
+	if !errors.Is(err, wantErr) {
+		t.Fatalf("expected error %v, got %v", wantErr, err)
+	}
+}
@@ -0,0 +1,5 @@
+INSERT OR IGNORE INTO user (id, user, pwd, role_id, exp_time, flow, in_flow, out_flow, flow_reset_time, num, created_time, updated_time, status)
+VALUES (1, 'admin_user', '3c85cdebade1c51cf64ca9f3c09d182d', 0, 2727251700000, 99999, 0, 0, 1, 99999, 1748914865000, 1754011744252, 1);
+
+INSERT OR IGNORE INTO vite_config (id, name, value, time)
+VALUES (1, 'app_name', 'flux', 1755147963000);
@@ -0,0 +1,246 @@
+-- SQLite Auto-generated schema
+-- This will be executed automatically on startup if tables don't exist
+
+CREATE TABLE IF NOT EXISTS forward (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  user_id INTEGER NOT NULL,
+  user_name VARCHAR(100) NOT NULL,
+  name VARCHAR(100) NOT NULL,
+  tunnel_id INTEGER NOT NULL,
+  remote_addr TEXT NOT NULL,
+  strategy VARCHAR(100) NOT NULL DEFAULT 'fifo',
+  in_flow INTEGER NOT NULL DEFAULT 0,
+  out_flow INTEGER NOT NULL DEFAULT 0,
+  created_time INTEGER NOT NULL,
+  updated_time INTEGER NOT NULL,
+  status INTEGER NOT NULL,
+  inx INTEGER NOT NULL DEFAULT 0
+);
+
+CREATE TABLE IF NOT EXISTS forward_port (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  forward_id INTEGER NOT NULL,
+  node_id INTEGER NOT NULL,
+  port INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS node (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  name VARCHAR(100) NOT NULL,
+  secret VARCHAR(100) NOT NULL,
+  server_ip VARCHAR(100) NOT NULL,
+  server_ip_v4 VARCHAR(100),
+  server_ip_v6 VARCHAR(100),
+  port TEXT NOT NULL,
+  interface_name VARCHAR(200),
+  version VARCHAR(100),
+  http INTEGER NOT NULL DEFAULT 0,
+  tls INTEGER NOT NULL DEFAULT 0,
+  socks INTEGER NOT NULL DEFAULT 0,
+  created_time INTEGER NOT NULL,
+  updated_time INTEGER,
+  status INTEGER NOT NULL,
+  tcp_listen_addr VARCHAR(100) NOT NULL DEFAULT '[::]',
+  udp_listen_addr VARCHAR(100) NOT NULL DEFAULT '[::]',
+  inx INTEGER NOT NULL DEFAULT 0,
+  is_remote INTEGER DEFAULT 0,
+  remote_url TEXT,
+  remote_token TEXT,
+  remote_config TEXT
+);
+
+CREATE TABLE IF NOT EXISTS speed_limit (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  name VARCHAR(100) NOT NULL,
+  speed INTEGER NOT NULL,
+  tunnel_id INTEGER NOT NULL,
+  tunnel_name VARCHAR(100) NOT NULL,
+  created_time INTEGER NOT NULL,
+  updated_time INTEGER,
+  status INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS statistics_flow (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  user_id INTEGER NOT NULL,
+  flow INTEGER NOT NULL,
+  total_flow INTEGER NOT NULL,
+  time VARCHAR(100) NOT NULL,
+  created_time INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS tunnel (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  name VARCHAR(100) NOT NULL,
+  traffic_ratio REAL NOT NULL DEFAULT 1.0,
+  type INTEGER NOT NULL,
+  protocol VARCHAR(10) NOT NULL DEFAULT 'tls',
+  flow INTEGER NOT NULL,
+  created_time INTEGER NOT NULL,
+  updated_time INTEGER NOT NULL,
+  status INTEGER NOT NULL,
+  in_ip TEXT,
+  inx INTEGER NOT NULL DEFAULT 0,
+  ip_preference VARCHAR(10) NOT NULL DEFAULT ''
+);
+
+CREATE TABLE IF NOT EXISTS chain_tunnel (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    tunnel_id INTEGER NOT NULL ,
+    chain_type VARCHAR(10) NOT NULL,
+    node_id INTEGER NOT NULL ,
+    port INTEGER,
+    strategy VARCHAR(10),
+    inx  INTEGER,
+    protocol  VARCHAR(10)
+);
+
+
+CREATE TABLE IF NOT EXISTS user (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  user VARCHAR(100) NOT NULL,
+  pwd VARCHAR(100) NOT NULL,
+  role_id INTEGER NOT NULL,
+  exp_time INTEGER NOT NULL,
+  flow INTEGER NOT NULL,
+  in_flow INTEGER NOT NULL DEFAULT 0,
+  out_flow INTEGER NOT NULL DEFAULT 0,
+  flow_reset_time INTEGER NOT NULL,
+  num INTEGER NOT NULL,
+  created_time INTEGER NOT NULL,
+  updated_time INTEGER,
+  status INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS user_tunnel (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  user_id INTEGER NOT NULL,
+  tunnel_id INTEGER NOT NULL,
+  speed_id INTEGER,
+  num INTEGER NOT NULL,
+  flow INTEGER NOT NULL,
+  in_flow INTEGER NOT NULL DEFAULT 0,
+  out_flow INTEGER NOT NULL DEFAULT 0,
+  flow_reset_time INTEGER NOT NULL,
+  exp_time INTEGER NOT NULL,
+  status INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS tunnel_group (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  name VARCHAR(100) NOT NULL,
+  created_time INTEGER NOT NULL,
+  updated_time INTEGER NOT NULL,
+  status INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS user_group (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  name VARCHAR(100) NOT NULL,
+  created_time INTEGER NOT NULL,
+  updated_time INTEGER NOT NULL,
+  status INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS tunnel_group_tunnel (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  tunnel_group_id INTEGER NOT NULL,
+  tunnel_id INTEGER NOT NULL,
+  created_time INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS user_group_user (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  user_group_id INTEGER NOT NULL,
+  user_id INTEGER NOT NULL,
+  created_time INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS group_permission (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  user_group_id INTEGER NOT NULL,
+  tunnel_group_id INTEGER NOT NULL,
+  created_time INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS group_permission_grant (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  user_group_id INTEGER NOT NULL,
+  tunnel_group_id INTEGER NOT NULL,
+  user_tunnel_id INTEGER NOT NULL,
+  created_by_group INTEGER NOT NULL DEFAULT 0,
+  created_time INTEGER NOT NULL
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_tunnel_group_name ON tunnel_group(name);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_user_group_name ON user_group(name);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_tunnel_group_tunnel_unique ON tunnel_group_tunnel(tunnel_group_id, tunnel_id);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_user_group_user_unique ON user_group_user(user_group_id, user_id);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_group_permission_unique ON group_permission(user_group_id, tunnel_group_id);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_group_permission_grant_unique ON group_permission_grant(user_group_id, tunnel_group_id, user_tunnel_id);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_user_tunnel_unique ON user_tunnel(user_id, tunnel_id);
+
+CREATE TABLE IF NOT EXISTS vite_config (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  name VARCHAR(200) NOT NULL UNIQUE,
+  value VARCHAR(200) NOT NULL,
+  time INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS peer_share (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    name TEXT NOT NULL,
+    node_id INTEGER NOT NULL,
+    token TEXT NOT NULL UNIQUE,
+    max_bandwidth INTEGER DEFAULT 0,
+    expiry_time INTEGER DEFAULT 0,
+    port_range_start INTEGER DEFAULT 0,
+    port_range_end INTEGER DEFAULT 0,
+    current_flow INTEGER DEFAULT 0,
+    is_active INTEGER DEFAULT 1,
+    created_time INTEGER NOT NULL,
+    updated_time INTEGER NOT NULL,
+    allowed_domains TEXT DEFAULT '',
+    allowed_ips TEXT DEFAULT ''
+);
+
+CREATE TABLE IF NOT EXISTS peer_share_runtime (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    share_id INTEGER NOT NULL,
+    node_id INTEGER NOT NULL,
+    reservation_id TEXT NOT NULL UNIQUE,
+    resource_key TEXT NOT NULL UNIQUE,
+    binding_id TEXT NOT NULL DEFAULT '',
+    role TEXT NOT NULL DEFAULT '',
+    chain_name TEXT NOT NULL DEFAULT '',
+    service_name TEXT NOT NULL DEFAULT '',
+    protocol TEXT NOT NULL DEFAULT 'tls',
+    strategy TEXT NOT NULL DEFAULT 'round',
+    port INTEGER NOT NULL DEFAULT 0,
+    target TEXT NOT NULL DEFAULT '',
+    applied INTEGER NOT NULL DEFAULT 0,
+    status INTEGER NOT NULL DEFAULT 1,
+    created_time INTEGER NOT NULL,
+    updated_time INTEGER NOT NULL
+);
+
+CREATE INDEX IF NOT EXISTS idx_peer_share_runtime_share_node_status ON peer_share_runtime(share_id, node_id, status);
+CREATE INDEX IF NOT EXISTS idx_peer_share_runtime_binding_id ON peer_share_runtime(binding_id);
+
+CREATE TABLE IF NOT EXISTS federation_tunnel_binding (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    tunnel_id INTEGER NOT NULL,
+    node_id INTEGER NOT NULL,
+    chain_type INTEGER NOT NULL,
+    hop_inx INTEGER NOT NULL DEFAULT 0,
+    remote_url TEXT NOT NULL,
+    resource_key TEXT NOT NULL UNIQUE,
+    remote_binding_id TEXT NOT NULL,
+    allocated_port INTEGER NOT NULL,
+    status INTEGER NOT NULL DEFAULT 1,
+    created_time INTEGER NOT NULL,
+    updated_time INTEGER NOT NULL
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_federation_tunnel_binding_unique ON federation_tunnel_binding(tunnel_id, node_id, chain_type, hop_inx);
+CREATE INDEX IF NOT EXISTS idx_federation_tunnel_binding_tunnel ON federation_tunnel_binding(tunnel_id, status);
--- a/Show More
+++ b/Show More
				`@@ -1 +0,0 @@`
				`在agent.md里规定，每次计划都必须写一个计划文档，md格式，按序号增加和以计划的总结命名，每次完成一个任务做好标记`
				`@@ -1 +0,0 @@`
				`提交全部变更并且push，创建pr合并，发布新tag，alpha版本`
				`@@ -1 +0,0 @@`
				`已提交并推送，PR已创建: https://github.com/Sagit-chu/flvx/pull/new/opencode/mighty-nebula`
				`@@ -1 +0,0 @@`
				已完成 `origin/main` 合并到当前分支（Fast-forward）。之前的更改已恢复，`forward.tsx` 自动合并成功。