@abtnode/core 1.15.17 → 1.16.0-beta-b16cb035

package/lib/blocklet/manager/disk.js

@@ -2,55 +2,73 @@
 /* eslint-disable no-await-in-loop */
 const fs = require('fs-extra');
 const path = require('path');
+const flat = require('flat');
 const get = require('lodash/get');
+const merge = require('lodash/merge');
+const pick = require('lodash/pick');
 const cloneDeep = require('lodash/cloneDeep');
-const semver = require('semver');
-const capitalize = require('lodash/capitalize');
-const diff = require('deep-diff');
-const { Throttle } = require('stream-throttle');
-const LRU = require('lru-cache');
-
-const { isValid: isValidDid } = require('@arcblock/did');
-const { verifyPresentation } = require('@arcblock/vc');
-const { toBase58 } = require('@ocap/util');
-const { fromSecretKey } = require('@ocap/wallet');
+const { isNFTExpired, getNftExpirationDate } = require('@abtnode/util/lib/nft');
+const didDocument = require('@abtnode/util/lib/did-document');
+const { sign } = require('@arcblock/jwt');
+const { toSvg: createDidLogo } =
+  process.env.NODE_ENV !== 'test' ? require('@arcblock/did-motif') : require('@arcblock/did-motif/dist/did-motif.cjs');
+const getBlockletInfo = require('@blocklet/meta/lib/info');
+const sleep = require('@abtnode/util/lib/sleep');
 
 const logger = require('@abtnode/logger')('@abtnode/core:blocklet:manager');
-const hashFiles = require('@abtnode/util/lib/hash-files');
-const downloadFile = require('@abtnode/util/lib/download-file');
-const Lock = require('@abtnode/util/lib/lock');
-const { getVcFromPresentation } = require('@abtnode/util/lib/vc');
-const { BLOCKLET_PURCHASE_NFT_TYPE } = require('@abtnode/constant');
+const {
+  WHO_CAN_ACCESS,
+  WHO_CAN_ACCESS_PREFIX_ROLES,
+  BLOCKLET_INSTALL_TYPE,
+  NODE_MODES,
+  APP_STRUCT_VERSION,
+} = require('@abtnode/constant');
 
 const getBlockletEngine = require('@blocklet/meta/lib/engine');
-const { isFreeBlocklet } = require('@blocklet/meta/lib/payment');
-const validateBlockletEntry = require('@blocklet/meta/lib/entry');
-const { getRequiredMissingConfigs } = require('@blocklet/meta/lib/util');
+const {
+  isDeletableBlocklet,
+  getAppMissingConfigs,
+  hasRunnableComponent,
+  forEachBlockletSync,
+  forEachChildSync,
+  forEachBlocklet,
+  getComponentId,
+  isPreferenceKey,
+  getRolesFromAuthConfig,
+} = require('@blocklet/meta/lib/util');
+const getComponentProcessId = require('@blocklet/meta/lib/get-component-process-id');
+const { update: updateMetaFile } = require('@blocklet/meta/lib/file');
+const { titleSchema, updateMountPointSchema, environmentNameSchema } = require('@blocklet/meta/lib/schema');
+const Lock = require('@abtnode/util/lib/lock');
 
 const {
   BlockletStatus,
   BlockletSource,
   BlockletEvents,
-  BLOCKLET_BUNDLE_FOLDER,
   BLOCKLET_MODES,
   BlockletGroup,
   fromBlockletStatus,
   fromBlockletSource,
-} = require('@blocklet/meta/lib/constants');
+  BLOCKLET_DEFAULT_PORT_NAME,
+  BLOCKLET_INTERFACE_TYPE_WEB,
+  BLOCKLET_INTERFACE_PUBLIC,
+  BLOCKLET_DYNAMIC_PATH_PREFIX,
+  BLOCKLET_INTERFACE_PROTOCOL_HTTP,
+  BLOCKLET_DEFAULT_PATH_REWRITE,
+  BLOCKLET_DEFAULT_VERSION,
+  BLOCKLET_LATEST_SPEC_VERSION,
+  BLOCKLET_META_FILE,
+  BLOCKLET_CONFIGURABLE_KEY,
+} = require('@blocklet/constant');
 const util = require('../../util');
 const {
   refresh: refreshAccessibleExternalNodeIp,
   getFromCache: getAccessibleExternalNodeIp,
 } = require('../../util/get-accessible-external-node-ip');
 const {
-  forEachBlocklet,
-  getBlockletDirs,
-  getBlockletMetaFromUrl,
-  fillBlockletConfigs,
-  ensureBlockletExpanded,
-  getRootSystemEnvironments,
-  getSystemEnvironments,
-  getOverwrittenEnvironments,
+  getAppSystemEnvironments,
+  getComponentSystemEnvironments,
+  getAppOverwrittenEnvironments,
   getHealthyCheckTimeout,
   startBlockletProcess,
   stopBlockletProcess,
@@ -59,39 +77,59 @@ const {
   getBlockletStatusFromProcess,
   checkBlockletProcessHealthy,
   validateBlocklet,
-  getChildrenMeta,
   statusMap,
-  expandTarball,
-  verifyIntegrity,
   pruneBlockletBundle,
   getDiskInfo,
-  getRuntimeInfo,
-  mergeMeta,
-  getUpdateMetaList,
   getRuntimeEnvironments,
+  getTypeFromInstallParams,
+  parseComponents,
+  filterDuplicateComponents,
+  getBundleDir,
+  getBlocklet,
+  ensureEnvDefault,
+  getConfigFromPreferences,
+  consumeServerlessNFT,
+  validateAppConfig,
+  checkDuplicateMountPoint,
+  validateStore,
+  isRotatingAppSk,
+  isRotatingAppDid,
+  checkVersionCompatibility,
+  getBlockletKnownAs,
 } = require('../../util/blocklet');
 const states = require('../../states');
-const BlockletRegistry = require('../registry');
 const BaseBlockletManager = require('./base');
 const { get: getEngine } = require('./engine');
 const blockletPm2Events = require('./pm2-events');
-const { getFactoryState } = require('../../util/chain');
 const runMigrationScripts = require('../migration');
 const hooks = require('../hooks');
+const { getDidDomainForBlocklet } = require('../../util/get-domain-for-blocklet');
+const handleInstanceInStore = require('../../util/public-to-store');
+const { BlockletRuntimeMonitor } = require('../../monitor/blocklet-runtime-monitor');
+const getHistoryList = require('../../monitor/get-history-list');
+const { SpacesBackup } = require('../storage/backup/spaces');
+const { SpacesRestore } = require('../storage/restore/spaces');
+const { installApplicationFromGeneral } = require('./helper/install-application-from-general');
+const { installApplicationFromDev } = require('./helper/install-application-from-dev');
+const { installApplicationFromBackup } = require('./helper/install-application-from-backup');
+const { installComponentFromDev } = require('./helper/install-component-from-dev');
+const { installComponentFromUrl } = require('./helper/install-component-from-url');
+const { installComponentFromUpload, diff } = require('./helper/install-component-from-upload');
+const UpgradeComponents = require('./helper/upgrade-components');
+const BlockletDownloader = require('../downloader/blocklet-downloader');
+const RollbackCache = require('./helper/rollback-cache');
+const { migrateApplicationToStructV2 } = require('./helper/migrate-application-to-struct-v2');
 
 const {
   isInProgress,
   isBeforeInstalled,
-  getBlockletInterfaces,
   formatEnvironments,
   shouldUpdateBlockletStatus,
   getBlockletMeta,
-  validateBlockletMeta,
+  validateOwner,
 } = util;
 
-const preDownloadLock = new Lock('pre-download-lock');
-
-const asyncFs = fs.promises;
+const statusLock = new Lock('blocklet-status-lock');
 
 const pm2StatusMap = {
   online: BlockletStatus.running,
@@ -105,42 +143,64 @@ const pm2StatusMap = {
  */
 const getBlockletEngineNameByPlatform = (blockletMeta) => getBlockletEngine(blockletMeta).interpreter;
 
+const getSkippedProcessIds = ({ newBlocklet, oldBlocklet, context = {} }) => {
+  const { forceStartProcessIds = [] } = context;
+  const idMap = {};
+  const res = [];
+
+  forEachBlockletSync(oldBlocklet, (b, { ancestors }) => {
+    if (b.meta.dist?.integrity) {
+      idMap[getComponentProcessId(b, ancestors)] = b.meta.dist?.integrity;
+    }
+  });
+
+  forEachBlockletSync(newBlocklet, (b, { ancestors }) => {
+    const id = getComponentProcessId(b, ancestors);
+    if (forceStartProcessIds.includes(id)) {
+      return;
+    }
+
+    if (!b.meta.dist?.integrity || b.meta.dist.integrity === idMap[id]) {
+      res.push(id);
+    }
+  });
+
+  return res;
+};
+
+// 10s 上报统计一次
+const MONITOR_RECORD_INTERVAL_SEC = 10;
+
+// 保存当天数据, 每天上报 8640 次
+const MONITOR_HISTORY_LENGTH = 86400 / MONITOR_RECORD_INTERVAL_SEC;
+
 class BlockletManager extends BaseBlockletManager {
   /**
    * @param {*} dataDirs generate by ../../util:getDataDirs
    */
-  constructor({ dataDirs, registry, startQueue, installQueue, daemon = false }) {
+  constructor({ dataDirs, startQueue, installQueue, backupQueue, daemon = false, teamManager }) {
     super();
 
     this.dataDirs = dataDirs;
     this.installDir = dataDirs.blocklets;
-    this.state = states.blocklet;
-    this.node = states.node;
     this.startQueue = startQueue;
     this.installQueue = installQueue;
-    /**
-     * { did: Map({ <childDid>: <downloadFile.cancelCtrl> }) }
-     */
-    this.downloadCtrls = {};
-    /**
-     * { [download-did-version]: Lock }
-     */
-    this.downloadLocks = {};
-    this.registry = registry;
-    this.notification = states.notification;
-    this.session = states.session;
-    this.extras = states.blockletExtras;
-    this.cache = states.cache;
+    this.backupQueue = backupQueue;
+    this.teamManager = teamManager;
 
     // cached installed blocklets for performance
     this.cachedBlocklets = null;
 
-    // cached blocklet latest versions from each registries
-    this.cachedBlockletVersions = new LRU({
-      max: 40, // cache at most 40 blocklets
-      maxAge: process.env.NODE_ENV === 'test' ? 500 : 5 * 60 * 1000, // cache for 5 minute
+    this.runtimeMonitor = new BlockletRuntimeMonitor({ historyLength: MONITOR_HISTORY_LENGTH, states });
+
+    this.blockletDownloader = new BlockletDownloader({
+      installDir: this.installDir,
+      downloadDir: this.dataDirs.tmp,
+      cache: states.cache,
     });
 
+    this._rollbackCache = new RollbackCache({ dir: this.dataDirs.tmp });
+
     if (daemon) {
       blockletPm2Events.on('online', (data) => this._syncPm2Status('online', data.blockletDid));
       blockletPm2Events.on('stop', (data) => this._syncPm2Status('stop', data.blockletDid));
@@ -148,126 +208,278 @@ class BlockletManager extends BaseBlockletManager {
   }
 
   // ============================================================================================
-  // Public API that can be call from GQL, should have the same signature: doXXX(params, context)
+  // Public API for Installing/Upgrading Application or Components
   // ============================================================================================
 
   /**
-   * @param {Object} params
-   * @param {string} params.installId
-   * @param {string} params.sync default: false
+   *
+   *
+   * @param {{
+   *  url: string;
+   *  did: string;
+   *  title: string;
+   *  description: string;
+   *  storeUrl: string;
+   *  appSk: string;
+   *  sync: boolean = false; // download synchronously, not use queue
+   *  delay: number; // push download task to queue after a delay
+   *  downloadTokenList: Array<{did: string, token: string}>;
+   *  startImmediately: boolean;
+   *  controller: Controller
+   *  type: BLOCKLET_INSTALL_TYPE
+   * }} params
+   * @param {{
+   *  [key: string]: any
+   * }} context
+   * @return {*}
+   * @memberof BlockletManager
    */
-  async install(params, context) {
+  async install(params, context = {}) {
     logger.debug('install blocklet', { params, context });
-    if (params.url) {
-      return this._installFromUrl({ url: params.url, sync: params.sync }, context);
+
+    const type = getTypeFromInstallParams(params);
+
+    const { appSk } = params;
+    if (!appSk) {
+      throw new Error('appSk is required');
+    }
+
+    if (!params.controller && context?.user?.controller) {
+      params.controller = context.user.controller;
+    }
+
+    const info = await states.node.read();
+
+    // Note: if you added new header here, please change core/state/lib/blocklet/downloader/bundle-downloader.js to use that header
+    context.headers = Object.assign(context?.headers || {}, {
+      'x-server-did': info.did,
+      'x-server-public-key': info.pk,
+      'x-server-signature': sign(info.did, info.sk, {
+        exp: (Date.now() + 5 * 60 * 1000) / 1000,
+      }),
+    });
+    context.downloadTokenList = params.downloadTokenList || [];
+
+    if (typeof context.startImmediately === 'undefined') {
+      context.startImmediately = !!params.startImmediately;
     }
 
-    if (params.file) {
-      const { file, did, diffVersion, deleteSet } = params;
-      return this._installFromUpload({ file, did, diffVersion, deleteSet, context });
+    if (type === BLOCKLET_INSTALL_TYPE.RESTORE) {
+      const { url } = params;
+      return installApplicationFromBackup({ url, appSk, context, manager: this, states });
     }
 
-    if (params.did) {
-      return this._installFromRegistry({ did: params.did }, context);
+    if ([BLOCKLET_INSTALL_TYPE.URL, BLOCKLET_INSTALL_TYPE.STORE, BLOCKLET_INSTALL_TYPE.CREATE].includes(type)) {
+      return installApplicationFromGeneral({ ...params, type, context, manager: this, states });
     }
 
-    throw new Error('Can only install blocklet from url/file/did');
+    // should not be here
+    throw new Error(`install from ${type} is not supported`);
   }
 
-  // eslint-disable-next-line no-unused-vars
-  async getMetaFromUrl({ url, checkPrice = false }, context) {
-    const meta = await getBlockletMetaFromUrl(url);
-    let isFree = isFreeBlocklet(meta);
+  /**
+   * @param {String} rootDid
+   * @param {String} mountPoint
+   *
+   * installFromUrl
+   * @param {String} url
+   *
+   * InstallFromUpload
+   * @param {Object} file
+   * @param {String} did for diff upload or custom component did
+   * @param {String} diffVersion for diff upload
+   * @param {Array} deleteSet for diff upload
+   *
+   * Custom info
+   * @param {String} title custom component title
+   * @param {String} name custom component name
+   *
+   * @param {ConfigEntry} configs pre configs
+   */
+  async installComponent(
+    {
+      rootDid,
+      mountPoint: tmpMountPoint,
+      url,
+      file,
+      did,
+      diffVersion,
+      deleteSet,
+      title,
+      name,
+      configs,
+      sync,
+      downloadTokenList,
+    },
+    context = {}
+  ) {
+    const mountPoint = await updateMountPointSchema.validateAsync(tmpMountPoint);
+    logger.debug('start install component', { rootDid, mountPoint, url });
 
-    if (checkPrice && !isFree && meta.nftFactory) {
-      try {
-        const registryMeta = await BlockletRegistry.getRegistryMeta(new URL(url).origin);
+    if (file) {
+      // TODO: 如何触发这种场景？
+      const info = await states.node.read();
+      if (info.mode === NODE_MODES.SERVERLESS) {
+        throw new Error("Can't install component in serverless-mode server via upload");
+      }
 
-        if (registryMeta.chainHost) {
-          const state = await getFactoryState(registryMeta.chainHost, meta.nftFactory);
-          if (state) {
-            isFree = false;
-          }
-        }
-      } catch (error) {
-        logger.warn('failed when checking if the blocklet is free', { did: meta.did, error });
+      return installComponentFromUpload({
+        rootDid,
+        mountPoint,
+        file,
+        did,
+        diffVersion,
+        deleteSet,
+        context,
+        states,
+        manager: this,
+      });
+    }
+
+    if (url) {
+      const info = await states.node.read();
+      if (info.mode === NODE_MODES.SERVERLESS) {
+        validateStore(info, url);
       }
+
+      return installComponentFromUrl({
+        rootDid,
+        mountPoint,
+        url,
+        context,
+        title,
+        did,
+        name,
+        configs,
+        sync,
+        downloadTokenList,
+        states,
+        manager: this,
+      });
     }
 
-    meta.isFree = isFree;
+    // should not be here
+    throw new Error('Unknown source');
+  }
 
-    return meta;
+  async diff({ did, hashFiles, rootDid }) {
+    return diff({ did, hashFiles, rootDid, states, manager: this });
   }
 
-  async installBlockletFromVc({ vcPresentation, challenge }, context) {
-    logger.info('Install from vc');
-    const vc = getVcFromPresentation(vcPresentation);
+  /**
+   * After the dev function finished, the caller should send a BlockletEvents.installed event to the daemon
+   * @returns {Object} blocklet
+   */
+  async dev(folder, { rootDid, mountPoint, defaultStoreUrl } = {}) {
+    logger.info('dev component', { folder, rootDid, mountPoint });
 
-    // FIXME: 这里的 trustedIssuers 相当于相信任何 VC，需要想更安全的方法
-    verifyPresentation({ presentation: vcPresentation, trustedIssuers: [get(vc, 'issuer.id')], challenge });
+    const meta = getBlockletMeta(folder, { defaultStoreUrl });
+    if (meta.group !== 'static' && (!meta.scripts || !meta.scripts.dev)) {
+      throw new Error('Incorrect blocklet.yml: missing `scripts.dev` field');
+    }
 
-    if (!vc.type.includes(BLOCKLET_PURCHASE_NFT_TYPE)) {
-      throw new Error(`Expect ${BLOCKLET_PURCHASE_NFT_TYPE} VC type`);
+    if (!rootDid) {
+      return installApplicationFromDev({ folder, meta, manager: this, states });
     }
 
-    const blockletUrl = get(vc, 'credentialSubject.purchased.blocklet.url');
-    const urlObject = new URL(blockletUrl);
-    const did = get(vc, 'credentialSubject.purchased.blocklet.id');
-    const registry = urlObject.origin;
+    return installComponentFromDev({ folder, meta, rootDid, mountPoint, manager: this, states });
+  }
+
+  async checkComponentsForUpdates({ did }) {
+    return UpgradeComponents.check({ did, states });
+  }
+
+  async upgradeComponents({ updateId, selectedComponents: selectedComponentDids }, context = {}) {
+    return UpgradeComponents.upgrade({ updateId, selectedComponentDids, context, states, manager: this });
+  }
+
+  async migrateApplicationToStructV2({ did, appSk, context = {} }) {
+    return migrateApplicationToStructV2({ did, appSk, context, manager: this, states });
+  }
+
+  // ============================================================================================
+  // Public API for GQL or internal
+  // ============================================================================================
 
-    return this._installFromRegistry({ did, registry }, { ...context, blockletPurchaseVerified: true });
+  async getBlockletForLauncher({ did }) {
+    const blocklet = await states.blocklet.getBlocklet(did);
+    const isRunning = blocklet ? blocklet.status === BlockletStatus.running : false;
+    return { did, isInstalled: !!blocklet, isRunning };
   }
 
-  async start({ did, checkHealthImmediately = false, throwOnError }, context) {
+  async start({ did, throwOnError, checkHealthImmediately = false, e2eMode = false }, context) {
     logger.info('start blocklet', { did });
-    const blocklet = await this.ensureBlocklet(did);
+    // should check blocklet integrity
+    const blocklet = await this.ensureBlocklet(did, { e2eMode });
 
     try {
+      // blocklet may be manually stopped durning starting
+      // so error message would not be sent if blocklet is stopped
+      // so we need update status first
+      await states.blocklet.setBlockletStatus(did, BlockletStatus.starting);
+      blocklet.status = BlockletStatus.starting;
+
+      // validate requirement and engine
+      await validateBlocklet(blocklet);
+
+      if (!hasRunnableComponent(blocklet)) {
+        throw new Error('No runnable component found');
+      }
+
       // check required config
-      const missingProps = getRequiredMissingConfigs(blocklet);
+      const missingProps = getAppMissingConfigs(blocklet);
       if (missingProps.length) {
         throw new Error(
           `Missing required configuration to start the blocklet: ${missingProps.map((x) => x.key).join(',')}`
         );
       }
 
-      // update status
-      await this.state.setBlockletStatus(did, BlockletStatus.starting);
-      blocklet.status = BlockletStatus.starting;
       this.emit(BlockletEvents.statusChange, blocklet);
 
       if (blocklet.mode === BLOCKLET_MODES.DEVELOPMENT) {
         const { logsDir } = blocklet.env;
-        fs.removeSync(logsDir);
-        fs.mkdirSync(logsDir, { recursive: true });
+
+        try {
+          fs.removeSync(logsDir);
+          fs.mkdirSync(logsDir, { recursive: true });
+        } catch {
+          // Windows && Node.js 18.x 下会发生删除错误(ENOTEMPTY)
+          // 但是这个错误并不影响后续逻辑，所以这里对这个错误做了 catch
+        }
       }
 
-      // start process
-      const nodeEnvironments = await this.node.getEnvironments();
-      await startBlockletProcess(blocklet, {
-        preStart: (b) =>
-          hooks.preStart(b, {
+      const getHookFn =
+        (hookName) =>
+        (b, { env }) =>
+          hooks[hookName](b, {
             appDir: b.env.appDir,
             hooks: Object.assign(b.meta.hooks || {}, b.meta.scripts || {}),
-            env: getRuntimeEnvironments(b, nodeEnvironments),
+            env,
             did, // root blocklet did,
-            progress: blocklet.mode === BLOCKLET_MODES.DEVELOPMENT,
-          }),
+          });
+
+      // start process
+      const nodeEnvironments = await states.node.getEnvironments();
+      await startBlockletProcess(blocklet, {
+        ...context,
+        preStart: getHookFn('preStart'),
+        postStart: getHookFn('postStart'),
         nodeEnvironments,
-        nodeInfo: await this.node.read(),
+        nodeInfo: await states.node.read(),
+        e2eMode,
       });
 
       // check blocklet healthy
       const { startTimeout, minConsecutiveTime } = getHealthyCheckTimeout(blocklet, { checkHealthImmediately });
       const params = {
-        blocklet,
+        did,
         context,
         minConsecutiveTime,
         timeout: startTimeout,
       };
 
       if (checkHealthImmediately) {
-        await this.onCheckIfStarted(params, { throwOnError });
+        await this._onCheckIfStarted(params, { throwOnError });
       } else {
         this.startQueue.push({
           entity: 'blocklet',
@@ -279,10 +491,16 @@ class BlockletManager extends BaseBlockletManager {
 
       return blocklet;
     } catch (err) {
+      const status = await states.blocklet.getBlockletStatus(did);
+      if ([BlockletStatus.stopping, BlockletStatus.stopped].includes(status)) {
+        logger.info('Failed to start blocklet maybe due to manually stopped');
+        return states.blocklet.getBlocklet(did);
+      }
+
       const error = Array.isArray(err) ? err[0] : err;
       logger.error('Failed to start blocklet', { error, did, name: blocklet.meta.name });
       const description = `Start blocklet ${blocklet.meta.name} failed with error: ${error.message}`;
-      this.notification.create({
+      this._createNotification(did, {
         title: 'Start Blocklet Failed',
         description,
         entityType: 'blocklet',
@@ -291,8 +509,8 @@ class BlockletManager extends BaseBlockletManager {
       });
 
       await this.deleteProcess({ did });
-      const res = await this.state.setBlockletStatus(did, BlockletStatus.error);
-      this.emit(BlockletEvents.startFailed, res);
+      const res = await states.blocklet.setBlockletStatus(did, BlockletStatus.error);
+      this.emit(BlockletEvents.startFailed, { ...res, error: { message: error.message } });
 
       if (throwOnError) {
         throw new Error(description);
@@ -302,60 +520,119 @@ class BlockletManager extends BaseBlockletManager {
     }
   }
 
-  async stop({ did, updateStatus = true }, context) {
+  async stop({ did, updateStatus = true, silent = false }, context) {
     logger.info('stop blocklet', { did });
 
-    const blocklet = await this.ensureBlocklet(did);
-    const { appId } = blocklet.env;
+    const blocklet = await this.getBlocklet(did);
+    const { processId } = blocklet.env;
 
     if (updateStatus) {
-      await this.state.setBlockletStatus(did, BlockletStatus.stopping);
+      await states.blocklet.setBlockletStatus(did, BlockletStatus.stopping);
       blocklet.status = BlockletStatus.stopping;
       this.emit(BlockletEvents.statusChange, blocklet);
     }
 
-    const nodeEnvironments = await this.node.getEnvironments();
+    const nodeEnvironments = await states.node.getEnvironments();
 
     await stopBlockletProcess(blocklet, {
-      preStop: (b) =>
-        hooks.preStop({
+      preStop: (b, { ancestors }) =>
+        hooks.preStop(b.env.processId, {
           appDir: b.env.appDir,
           hooks: Object.assign(b.meta.hooks || {}, b.meta.scripts || {}),
-          env: getRuntimeEnvironments(b, nodeEnvironments),
+          env: getRuntimeEnvironments(b, nodeEnvironments, ancestors),
           did, // root blocklet did
-          notification: this.notification,
+          notification: states.notification,
           context,
           exitOnError: false,
-          progress: blocklet.mode === BLOCKLET_MODES.DEVELOPMENT,
+          silent,
         }),
     });
 
-    logger.info('blocklet stopped successfully', { appId, did });
+    logger.info('blocklet stopped successfully', { processId, did });
 
     if (updateStatus) {
       const res = await this.status(did, { forceSync: true });
+      // send notification to websocket channel
       this.emit(BlockletEvents.statusChange, res);
+
+      // send notification to wallet
+      this.emit(BlockletEvents.stopped, res);
+
       return res;
     }
 
     return blocklet;
   }
 
+  /**
+   * FIXME: @wangshijun create audit log for this
+   * @param {import('@abtnode/client').RequestBackupToSpacesInput} input
+   * @memberof BlockletManager
+   */
+  // eslint-disable-next-line no-unused-vars
+  async backupToSpaces({ appDid }, context) {
+    const blocklet = await states.blocklet.getBlocklet(appDid);
+    if (blocklet.structVersion !== APP_STRUCT_VERSION) {
+      throw new Error('Only new version app can be backup to spaces, please migrate this app first');
+    }
+
+    const userDid = context.user.did;
+    const { referrer } = context;
+
+    const spacesBackup = new SpacesBackup({ appDid, event: this, userDid, referrer });
+    this.emit(BlockletEvents.backupProgress, { appDid, message: 'Start backup...', progress: 10, completed: false });
+    await spacesBackup.backup();
+    this.emit(BlockletEvents.backupProgress, { appDid, completed: true, progress: 100 });
+  }
+
+  /**
+   * FIXME: @linchen support cancel
+   * FIXME: @wangshijun create audit log for this
+   * @param {import('@abtnode/client').RequestRestoreFromSpacesInput} input
+   * @memberof BlockletManager
+   */
+  // eslint-disable-next-line no-unused-vars
+  async restoreFromSpaces(input, context) {
+    this.emit(BlockletEvents.restoreProgress, { appDid: input.appDid, message: 'Start restore...', completed: false });
+
+    const userDid = context.user.did;
+
+    const spacesRestore = new SpacesRestore({ ...input, event: this, userDid, referrer: context.referrer });
+    const params = await spacesRestore.restore();
+
+    this.emit(BlockletEvents.restoreProgress, { appDid: input.appDid, message: 'Installing blocklet...' });
+    await installApplicationFromBackup({
+      url: `file://${spacesRestore.restoreDir}`,
+      moveDir: true,
+      ...merge(...params),
+      manager: this,
+      states,
+    });
+
+    this.emit(BlockletEvents.restoreProgress, { appDid: input.appDid, completed: true });
+  }
+
+  /**
+   *
+   * @param {import('@abtnode/client').RequestBlockletInput} param0
+   * @param {Record<string, any>} context
+   * @returns {import('@abtnode/client').BlockletState}
+   */
   async restart({ did }, context) {
     logger.info('restart blocklet', { did });
 
-    await this.state.setBlockletStatus(did, BlockletStatus.stopping);
-    const result = await this.state.getBlocklet(did);
+    await states.blocklet.setBlockletStatus(did, BlockletStatus.stopping);
+    const result = await states.blocklet.getBlocklet(did);
     this.emit(BlockletEvents.statusChange, result);
 
     const ticket = this.startQueue.push({ entity: 'blocklet', action: 'restart', id: did, did, context });
     ticket.on('failed', async (err) => {
       logger.error('failed to restart blocklet', { did, error: err });
 
-      const state = await this.state.setBlockletStatus(did, BlockletStatus.stopped);
+      const state = await states.blocklet.setBlockletStatus(did, BlockletStatus.stopped);
       this.emit(BlockletEvents.statusChange, state);
 
-      this.notification.create({
+      this._createNotification(did, {
         title: 'Blocklet Restart Failed',
         description: `Blocklet ${did} restart failed with error: ${err.message || 'queue exception'}`,
         entityType: 'blocklet',
@@ -369,109 +646,293 @@ class BlockletManager extends BaseBlockletManager {
 
   // eslint-disable-next-line no-unused-vars
   async reload({ did }, context) {
-    const blocklet = await this.ensureBlocklet(did);
+    const blocklet = await this.getBlocklet(did);
 
-    await this.state.setBlockletStatus(did, BlockletStatus.stopping);
+    await states.blocklet.setBlockletStatus(did, BlockletStatus.stopping);
     await reloadBlockletProcess(blocklet);
-    await this.state.setBlockletStatus(did, BlockletStatus.running);
+    await states.blocklet.setBlockletStatus(did, BlockletStatus.running);
     logger.info('blocklet reload successfully', { did });
 
     const res = await this.status(did);
-    this.emit(BlockletEvents.statusUpdated, res);
+    this.emit(BlockletEvents.statusChange, res);
     return res;
   }
 
   async delete({ did, keepData, keepLogsDir, keepConfigs }, context) {
     logger.info('delete blocklet', { did, keepData });
 
-    try {
-      const blocklet = await this.ensureBlocklet(did);
+    const blocklet = await this.getBlocklet(did);
 
-      const nodeEnvironments = await this.node.getEnvironments();
+    try {
+      if (isDeletableBlocklet(blocklet) === false) {
+        throw new Error('Blocklet is protected from accidental deletion');
+      }
 
+      const nodeEnvironments = await states.node.getEnvironments();
       await deleteBlockletProcess(blocklet, {
-        preDelete: (b) =>
-          hooks.preUninstall({
+        preDelete: (b, { ancestors }) =>
+          hooks.preUninstall(b.env.processId, {
             appDir: b.env.appDir,
             hooks: Object.assign(b.meta.hooks || {}, b.meta.scripts || {}),
-            env: getRuntimeEnvironments(b, nodeEnvironments),
+            env: getRuntimeEnvironments(b, nodeEnvironments, ancestors),
             did, // root blocklet did
-            notification: this.notification,
+            notification: states.notification,
             context,
             exitOnError: false,
           }),
       });
 
-      return this._deleteBlocklet({ did, keepData, keepLogsDir, keepConfigs }, context);
-    } catch (err) {
+      const doc = await this._deleteBlocklet({ did, keepData, keepLogsDir, keepConfigs }, context);
+      this._createNotification(doc.meta.did, {
+        title: 'Blocklet Deleted',
+        description: `Blocklet ${doc.meta.name}@${doc.meta.version} is deleted.`,
+        entityType: 'blocklet',
+        entityId: doc.meta.did,
+        severity: 'success',
+      });
+      return doc;
+    } catch (error) {
       // If we installed a corrupted blocklet accidentally, just cleanup the disk and state db
-      if (err.code === 'BLOCKLET_CORRUPTED') {
-        logger.info('blocklet is corrupted, will delete again', { did });
-        return this._deleteBlocklet({ did, keepData, keepLogsDir, keepConfigs }, context);
+      logger.error('blocklet delete failed, will delete again', { did, error });
+      const doc = await this._deleteBlocklet({ did, keepData, keepLogsDir, keepConfigs }, context);
+
+      this._createNotification(doc.meta.did, {
+        title: 'Blocklet Deleted',
+        description: `Blocklet ${doc.meta.name}@${doc.meta.version} is deleted.`,
+        entityType: 'blocklet',
+        entityId: doc.meta.did,
+        severity: 'success',
+      });
+
+      return doc;
+    }
+  }
+
+  async reset({ did, childDid }, context = {}) {
+    logger.info('reset blocklet', { did, childDid });
+
+    const blocklet = await this.getBlocklet(did);
+
+    if (isInProgress(blocklet.status || blocklet.status === BlockletStatus.running)) {
+      throw new Error('Cannot reset when blocklet is in progress');
+    }
+
+    try {
+      await this.deleteProcess({ did }, context);
+    } catch {
+      // do nothing
+    }
+
+    if (!childDid) {
+      // Cleanup disk storage
+      const { cacheDir, logsDir, dataDir } = blocklet.env;
+      fs.removeSync(cacheDir);
+      fs.removeSync(dataDir);
+      fs.removeSync(logsDir);
+
+      // Reset config in db
+      await states.blockletExtras.remove({ did: blocklet.meta.did });
+      await this._setConfigsFromMeta(did);
+      await this._updateBlockletEnvironment(did);
+      await this.resetSiteByDid(did, context);
+    } else {
+      const child = blocklet.children.find((x) => x.meta.did === childDid);
+
+      if (!child) {
+        throw new Error('Child does not exist');
       }
 
-      throw err;
+      // Cleanup disk storage
+      const { cacheDir, logsDir, dataDir } = child.env;
+      fs.removeSync(cacheDir);
+      fs.removeSync(dataDir);
+      fs.removeSync(logsDir);
+
+      // Reset config in db
+      await states.blockletExtras.delConfigs([blocklet.meta.did, child.meta.did]);
+      await this._setConfigsFromMeta(blocklet.meta.did, child.meta.did);
+      await this._updateBlockletEnvironment(did);
+    }
+
+    logger.info('blocklet reset', { did, childDid });
+    return blocklet;
+  }
+
+  async deleteComponent({ did, rootDid, keepData, keepState }, context) {
+    logger.info('delete blocklet component', { did, rootDid, keepData });
+
+    const blocklet = await this.getBlocklet(rootDid);
+
+    const child = blocklet.children.find((x) => x.meta.did === did);
+    if (!child) {
+      throw new Error('Component does not exist');
+    }
+
+    // delete state
+    const doc = await states.blocklet.getBlocklet(rootDid);
+    doc.children = doc.children.filter((x) => x.meta.did !== did);
+    const deletedChildren = await states.blockletExtras.getSettings(did, 'children', []);
+    if (keepData !== false && keepState !== false) {
+      deletedChildren.push({
+        meta: pick(child.meta, ['did', 'name', 'bundleDid', 'bundleName', 'version', 'title', 'description']),
+        mountPoint: child.mountPoint,
+        status: BlockletStatus.deleted,
+        deletedAt: new Date(),
+      });
+    }
+
+    await states.blocklet.updateBlocklet(rootDid, doc);
+    states.blockletExtras.setSettings(doc.meta.did, { children: deletedChildren });
+
+    // delete process
+    try {
+      const skippedProcessIds = [];
+      forEachBlockletSync(blocklet, (b) => {
+        if (!b.env.id.startsWith(child.env.id)) {
+          skippedProcessIds.push(b.env.processId);
+        }
+      });
+      await deleteBlockletProcess(blocklet, { skippedProcessIds });
+      logger.info('delete blocklet process for deleting component', { did, rootDid });
+    } catch (err) {
+      logger.error('delete blocklet process for deleting component', { did, rootDid, error: err });
+    }
+
+    // delete storage
+    const childBlocklet = blocklet.children.find((x) => x.meta.did === did);
+    const { cacheDir, logsDir, dataDir } = childBlocklet.env;
+    fs.removeSync(cacheDir);
+    fs.removeSync(logsDir);
+    if (keepData === false) {
+      fs.removeSync(dataDir);
+      await states.blockletExtras.delConfigs([blocklet.meta.did, child.meta.did]);
     }
+
+    const newBlocklet = await this.getBlocklet(rootDid);
+
+    await this._updateDependents(rootDid);
+
+    this.emit(BlockletEvents.upgraded, { blocklet: newBlocklet, context: { ...context, createAuditLog: false } }); // trigger router refresh
+
+    this._createNotification(newBlocklet.meta.did, {
+      title: 'Component Deleted',
+      description: `Component ${child.meta.name} of ${newBlocklet.meta.name} is successfully deleted.`,
+      entityType: 'blocklet',
+      entityId: newBlocklet.meta.did,
+      severity: 'success',
+      action: `/blocklets/${newBlocklet.meta.did}/components`,
+    });
+
+    return newBlocklet;
   }
 
-  async cancelDownload({ did }, context) {
-    await preDownloadLock.acquire();
+  async cancelDownload({ did: inputDid }) {
     try {
-      const blocklet = await this.state.getBlocklet(did);
+      await statusLock.acquire();
+      const blocklet = await states.blocklet.getBlocklet(inputDid);
       if (!blocklet) {
-        throw new Error('Can not cancel download for non-exist blocklet in database.', { did });
+        throw new Error(`Can not cancel download for non-exist blocklet in database. did: ${inputDid}`);
+      }
+
+      const { name, did, version } = blocklet.meta;
+
+      if (![BlockletStatus.downloading, BlockletStatus.waiting].includes(blocklet.status)) {
+        throw new Error(`Can not cancel blocklet that status is ${fromBlockletStatus(blocklet.status)}`);
       }
 
+      const job = await this.installQueue.get(did);
+
+      // cancel job
       if (blocklet.status === BlockletStatus.downloading) {
-        await this._cancelDownload(blocklet.meta, context);
+        try {
+          await this.blockletDownloader.cancelDownload(blocklet.meta.did);
+        } catch (error) {
+          logger.error('failed to exec blockletDownloader.download', { did: blocklet.meta.did, error });
+        }
       } else if (blocklet.status === BlockletStatus.waiting) {
-        await this._cancelWaiting(blocklet.meta, context);
+        try {
+          await this.installQueue.cancel(blocklet.meta.did);
+        } catch (error) {
+          logger.error('failed to cancel waiting', { did: blocklet.meta.did, error });
+        }
+      }
+
+      // rollback
+      if (job) {
+        const { postAction, oldBlocklet } = job;
+        await this._rollback(postAction, did, oldBlocklet);
       } else {
-        throw new Error(`Can not cancel blocklet that status is ${fromBlockletStatus(blocklet.status)}`);
+        const data = await this._rollbackCache.restore({ did });
+        if (data) {
+          const { action, oldBlocklet } = data;
+          await this._rollback(action, did, oldBlocklet);
+          await this._rollbackCache.remove({ did });
+        } else {
+          throw new Error(`Cannot find rollback data in queue or backup file of blocklet ${inputDid}`);
+        }
       }
 
-      preDownloadLock.release();
+      logger.info('cancel download blocklet', { did, name, version, status: fromBlockletStatus(blocklet.status) });
+
+      statusLock.release();
       return blocklet;
     } catch (error) {
-      preDownloadLock.release();
+      try {
+        // fallback blocklet status to error
+        const blocklet = await states.blocklet.getBlocklet(inputDid);
+        if (blocklet) {
+          await states.blocklet.setBlockletStatus(blocklet.meta.did, BlockletStatus.error);
+        }
+        statusLock.release();
+      } catch (err) {
+        statusLock.release();
+        logger.error('Failed to fallback blocklet status to error on cancelDownload', { error });
+      }
+
       throw error;
     }
   }
 
   // eslint-disable-next-line no-unused-vars
   async deleteProcess({ did }, context) {
-    const blocklet = await this.ensureBlocklet(did);
+    const blocklet = await this.getBlocklet(did);
 
     logger.info('delete blocklet process', { did });
 
-    await deleteBlockletProcess(blocklet);
+    await deleteBlockletProcess(blocklet, context);
 
-    const result = await this.state.setBlockletStatus(did, BlockletStatus.stopped);
+    const result = await states.blocklet.setBlockletStatus(did, BlockletStatus.stopped);
     logger.info('blocklet process deleted successfully', { did });
     return result;
   }
 
-  async detail({ did, attachRuntimeInfo = true }, context) {
+  // Get blocklet by blockletDid or appDid
+  async detail({ did, attachConfig = true, attachRuntimeInfo = true }, context) {
     if (!did) {
       throw new Error('did should not be empty');
     }
 
-    const nodeInfo = await this.node.read();
+    if (!attachConfig) {
+      return states.blocklet.getBlocklet(did);
+    }
 
     if (!attachRuntimeInfo) {
-      return this.state.getBlocklet(did);
+      try {
+        const blocklet = await this.getBlocklet(did, { throwOnNotExist: false });
+        return blocklet;
+      } catch (e) {
+        logger.error('get blocklet detail error', { error: e });
+        return states.blocklet.getBlocklet(did);
+      }
     }
 
-    return this.attachRuntimeInfo({ did, nodeInfo, diskInfo: true, context });
-  }
+    const nodeInfo = await states.node.read();
 
-  async list({ includeRuntimeInfo = true, useCache = true } = {}, context) {
-    const blocklets = await this.state.getBlocklets();
-    if (!includeRuntimeInfo) {
-      return blocklets;
-    }
+    return this._attachRuntimeInfo({ did, nodeInfo, diskInfo: true, context });
+  }
 
-    const nodeInfo = await this.node.read();
+  async attachBlockletListRuntimeInfo({ blocklets, useCache }, context) {
+    const nodeInfo = await states.node.read();
     const updated = (
       await Promise.all(
         blocklets.map((x) => {
@@ -482,7 +943,7 @@ class BlockletManager extends BaseBlockletManager {
           const cachedBlocklet =
             useCache && this.cachedBlocklets ? this.cachedBlocklets.find((y) => y.meta.did === x.meta.did) : null;
 
-          return this.attachRuntimeInfo({
+          return this._attachRuntimeInfo({
             did: x.meta.did,
             nodeInfo,
             diskInfo: false,
@@ -497,411 +958,296 @@ class BlockletManager extends BaseBlockletManager {
     return updated;
   }
 
+  async list({ includeRuntimeInfo = true, useCache = true, query, filter } = {}, context) {
+    const condition = { ...flat(query || {}) };
+    if (filter === 'external-only') {
+      condition.controller = {
+        $exists: true,
+      };
+    }
+
+    if (filter === 'external-excluded') {
+      condition.controller = {
+        $exists: false,
+      };
+    }
+
+    const blocklets = await states.blocklet.getBlocklets(condition);
+
+    if (includeRuntimeInfo) {
+      return this.attachBlockletListRuntimeInfo({ blocklets, useCache }, context);
+    }
+
+    return blocklets;
+  }
+
+  // CAUTION: this method currently only support config by blocklet.meta.did
   // eslint-disable-next-line no-unused-vars
-  async config({ did, childDid, configs: newConfigs }, context) {
-    logger.info('config blocklet', { did });
+  async config({ did, configs: newConfigs, skipHook, skipDidDocument }, context) {
+    // todo: skipDidDocument will be deleted
     if (!Array.isArray(newConfigs)) {
       throw new Error('configs list is not an array');
     }
 
-    let blocklet = await this.ensureBlocklet(did);
-    if (childDid) {
+    const dids = Array.isArray(did) ? did : [did];
+    const [rootDid, ...childDids] = dids;
+    logger.info('config blocklet', { dids });
+
+    let blocklet = await this.getBlocklet(rootDid);
+    for (const childDid of childDids) {
       blocklet = blocklet.children.find((x) => x.meta.did === childDid);
       if (!blocklet) {
-        throw new Error('Child blocklet does not exist', { did, childDid });
+        throw new Error('Child blocklet does not exist', { dids });
       }
     }
 
     // run hook
-    const nodeEnvironments = await this.node.getEnvironments();
-    newConfigs.forEach((x) => {
-      if (x.key === 'BLOCKLET_APP_SK') {
-        try {
-          fromSecretKey(x.value);
-        } catch {
-          try {
-            fromSecretKey(x.value, 'eth');
-          } catch {
-            throw new Error('Invalid custom blocklet secret key');
-          }
+    const nodeEnvironments = await states.node.getEnvironments();
+    for (const x of newConfigs) {
+      if (x.custom === true) {
+        // custom key
+        await environmentNameSchema.validateAsync(x.key);
+      } else if (BLOCKLET_CONFIGURABLE_KEY[x.key] && x.key.startsWith('BLOCKLET_')) {
+        // app key
+        if (childDids.length) {
+          logger.error(`Cannot set ${x.key} to child blocklet`, [dids]);
+          throw new Error(`Cannot set ${x.key} to child blocklet`);
         }
-      }
 
-      if (x.key === 'BLOCKLET_WALLET_TYPE') {
-        if (['default', 'eth'].includes(x.value) === false) {
-          throw new Error('Invalid blocklet wallet type, only "default" and "eth" are supported');
+        await validateAppConfig(x, states);
+      } else if (!BLOCKLET_CONFIGURABLE_KEY[x.key] && !isPreferenceKey(x)) {
+        if (!(blocklet.meta.environments || []).some((y) => y.name === x.key)) {
+          // forbid unknown format key
+          throw new Error(`unknown format key: ${x.key}`);
         }
       }
 
       blocklet.configObj[x.key] = x.value;
-    });
-    await hooks.preConfig({
-      appDir: blocklet.env.appDir,
-      hooks: Object.assign(blocklet.meta.hooks || {}, blocklet.meta.scripts || {}),
-      exitOnError: true,
-      env: { ...getRuntimeEnvironments(blocklet, nodeEnvironments), ...blocklet.configObj },
-      notification: this.notification,
-      did,
-      context,
-      progress: blocklet.mode === BLOCKLET_MODES.DEVELOPMENT,
-    });
+    }
+
+    if (!skipHook) {
+      // FIXME: we should also call preConfig for child blocklets
+      await hooks.preConfig(blocklet.env.processId, {
+        appDir: blocklet.env.appDir,
+        hooks: Object.assign(blocklet.meta.hooks || {}, blocklet.meta.scripts || {}),
+        exitOnError: true,
+        env: { ...getRuntimeEnvironments(blocklet, nodeEnvironments), ...blocklet.configObj },
+        did,
+        context,
+      });
+    }
+
+    const willAppSkChange = isRotatingAppSk(newConfigs, blocklet.configs, blocklet.externalSk);
+    const willAppDidChange = isRotatingAppDid(newConfigs, blocklet.configs, blocklet.externalSk);
 
     // update db
-    const configs = childDid
-      ? await this.extras.setChildConfigs(did, childDid, newConfigs)
-      : await this.extras.setConfigs(did, newConfigs);
+    await states.blockletExtras.setConfigs(dids, newConfigs);
+
+    if (willAppSkChange) {
+      const info = await states.node.read();
+      const { wallet } = getBlockletInfo(blocklet, info.sk);
+      const migratedFrom = Array.isArray(blocklet.migratedFrom) ? blocklet.migratedFrom : [];
+      await states.blocklet.updateBlocklet(rootDid, {
+        migratedFrom: [
+          ...migratedFrom,
+          { appSk: wallet.secretKey, appDid: wallet.address, at: new Date().toISOString() },
+        ],
+      });
+    }
 
-    const newState = await this.updateBlockletEnvironment(did);
+    // Reload nginx to make sure did-space can embed content from this app
+    if (newConfigs.find((x) => x.key === BLOCKLET_CONFIGURABLE_KEY.BLOCKLET_APP_SPACE_ENDPOINT)?.value) {
+      this.emit(BlockletEvents.spaceConnected, blocklet);
+    }
 
-    // response
-    if (!childDid) {
-      newState.configs = configs;
-    } else {
-      const c = newState.children.find((x) => x.meta.did === childDid);
-      c.configs = configs;
+    if (willAppDidChange && !skipDidDocument) {
+      await this._updateDidDocument(blocklet);
     }
 
+    await this._updateBlockletEnvironment(rootDid);
+
+    // response
+    const newState = await this.getBlocklet(rootDid);
     this.emit(BlockletEvents.updated, newState);
     return newState;
   }
 
-  /**
-   * upgrade blocklet from registry
-   */
-  async upgrade({ did, registryUrl }, context) {
-    const blocklet = await this.state.getBlocklet(did);
+  async configPublicToStore({ did, publicToStore = false }) {
+    const blocklet = await this.getBlocklet(did);
+    // publicToStore 由用户传入
+    // handleInstanceInStore 方法写在前面，保证向 store 操作成功后才会更改 blocklet 中的 publicToStore值
+    // handleInstanceInStore 中会校验修改 publicToStore字段 的条件，不符合则会抛错，就不会执行下面更新 publicToStore 的逻辑
+    await handleInstanceInStore(blocklet, { publicToStore });
+    await states.blockletExtras.setSettings(did, { publicToStore });
+
+    const newState = await this.getBlocklet(did);
+    return newState;
+  }
 
-    // TODO: 查看了下目前页面中的升级按钮，都是会传 registryUrl 过来的，这个函数里的逻辑感觉需要在以后做一个简化
-    if (!registryUrl && blocklet.source !== BlockletSource.registry) {
-      throw new Error('Wrong upgrade source, empty registryUrl or not installed from blocklet registry');
+  async configNavigations({ did, navigations = [] }) {
+    if (!Array.isArray(navigations)) {
+      throw new Error('navigations is not an array');
     }
+    await states.blockletExtras.setSettings(did, { navigations });
 
-    const upgradeFromRegistry = registryUrl || blocklet.deployedFrom;
+    const newState = await this.getBlocklet(did);
+    this.emit(BlockletEvents.updated, newState);
+    return newState;
+  }
 
-    const newVersionBlocklet = await this.registry.getBlockletMeta(
-      {
-        did,
-        registryUrl: upgradeFromRegistry,
-      },
-      context
-    );
+  async updateWhoCanAccess({ did, whoCanAccess }) {
+    const dids = Array.isArray(did) ? did : [did];
 
-    function getSignature(signatures = [], oldSignatures = []) {
-      // if blocklet installed from local, upload, url, the signature is undefined, should return null
-      if (!Array.isArray(signatures) || signatures.length === 0) {
-        return null;
-      }
-      if (signatures.length > 3) {
-        throw new Error('Invalid blocklet signature length');
-      }
-      // if old signature is old registry version, return new signatures last one signature
-      if (oldSignatures.length > 0 && oldSignatures.length < 3) {
-        return signatures[signatures.length - 1];
+    const [rootDid] = dids;
+
+    const isApp = dids.length === 1;
+
+    try {
+      // check exist
+      if (!(await this.hasBlocklet({ did: rootDid }))) {
+        throw new Error('The blocklet does not exist');
       }
-      // old registry signatures: [ registry 签名, developer-sk 签名]
-      // new registry signatures [ registry 签名, user wallet 签名, access-token 签名 ]
-      // old -> old: 需要对比 developer-sk 签名
-      // old -> new: 需要对比 developer-sk 和 access-token 签名
-      // new -> new: 需要对比 user-wallet 签名
-      return signatures.length === 1 ? signatures[0] : signatures[1];
-    }
 
-    const currentDeveloperSignature = getSignature(blocklet.meta.signatures);
-    const newVersionDeveloperSignature = getSignature(newVersionBlocklet.signatures, blocklet.meta.signatures);
+      // validate input
+      if (
+        !whoCanAccess.startsWith(WHO_CAN_ACCESS_PREFIX_ROLES) &&
+        !Object.values(WHO_CAN_ACCESS).includes(whoCanAccess)
+      ) {
+        throw new Error(`The value of whoCanAccess is invalid: ${whoCanAccess}`);
+      } else if (whoCanAccess.startsWith(WHO_CAN_ACCESS_PREFIX_ROLES)) {
+        if (!whoCanAccess.substring(WHO_CAN_ACCESS_PREFIX_ROLES.length).trim()) {
+          throw new Error('Roles in whoCanAccess cannot be empty');
+        }
 
-    if (!newVersionDeveloperSignature) {
-      throw new Error('Invalid upgrade blocklet signature');
-    }
+        if (whoCanAccess.length > 200) {
+          throw new Error('The length of whoCanAccess should not exceed 200');
+        }
 
-    if (
-      currentDeveloperSignature &&
-      blocklet.source === BlockletSource.registry &&
-      (currentDeveloperSignature.signer !== newVersionDeveloperSignature.signer ||
-        currentDeveloperSignature.pk !== newVersionDeveloperSignature.pk)
-    ) {
-      logger.error('invalid developer signature', { did, currentDeveloperSignature, newVersionDeveloperSignature });
-      throw new Error('Invalid developer signature');
+        const roleNames = (await this.teamManager.getRoles(rootDid)).map((x) => x.name);
+        const accessRoleNames = getRolesFromAuthConfig({ whoCanAccess });
+        const noExistNames = accessRoleNames.filter((x) => !roleNames.includes(x));
+        if (noExistNames.length) {
+          throw new Error(`Found no exist role names: ${noExistNames.join(',')}`);
+        }
+      }
+    } catch (error) {
+      logger.error(error.message);
+      throw error;
     }
 
-    if (blocklet.meta.version === newVersionBlocklet.version) {
-      throw new Error('Upgrade/downgrade blocklet to same version is noop');
+    if (isApp) {
+      await states.blockletExtras.setSettings(rootDid, { whoCanAccess });
+    } else {
+      const configs = [{ key: BLOCKLET_CONFIGURABLE_KEY.COMPONENT_ACCESS_WHO, value: whoCanAccess }];
+      await states.blockletExtras.setConfigs(dids, configs);
     }
 
-    const action = semver.gt(blocklet.meta.version, newVersionBlocklet.version) ? 'downgrade' : 'upgrade';
-    logger.info(`${action} blocklet`, { did });
+    const blocklet = await this.getBlocklet(rootDid);
 
-    return this._upgrade({
-      meta: newVersionBlocklet,
-      source: BlockletSource.registry,
-      deployedFrom: upgradeFromRegistry,
-      context,
-    });
+    this.emit(BlockletEvents.updated, { meta: { did: blocklet.meta.did } });
+
+    return blocklet;
   }
 
-  // eslint-disable-next-line no-unused-vars
-  async diff({ did, hashFiles: clientFiles }, context) {
-    if (!did) {
-      throw new Error('did is empty');
-    }
-    if (!clientFiles || !clientFiles.length) {
-      throw new Error('hashFiles is empty');
-    }
+  async updateComponentTitle({ did, rootDid: inputRootDid, title }) {
+    await titleSchema.validateAsync(title);
 
-    logger.info('Get blocklet diff', { did, clientFilesNumber: clientFiles.length });
+    const blocklet = await states.blocklet.getBlocklet(inputRootDid);
 
-    const state = await this.state.getBlocklet(did);
-    if (!state) {
-      return {
-        hasBlocklet: false,
-      };
-    }
-    if (state.source === BlockletSource.local) {
-      throw new Error(`Blocklet ${state.meta.name} is already deployed from local, can not deployed from remote.`);
+    if (!blocklet) {
+      throw new Error('blocklet does not exist');
     }
-    const { name, version } = state.meta;
-    const installDir = path.join(this.installDir, name, version);
-    // eslint-disable-next-line no-param-reassign
-    clientFiles = clientFiles.reduce((obj, item) => {
-      obj[item.file] = item.hash;
-      return obj;
-    }, {});
 
-    const { files } = await hashFiles(installDir, {
-      filter: (x) => x.indexOf('node_modules') === -1,
-      concurrentHash: 1,
-    });
-    logger.info('Get files hash', { filesNum: Object.keys(files).length });
-
-    const addSet = [];
-    const changeSet = [];
-    const deleteSet = [];
-    const diffFiles = diff(files, clientFiles);
-    if (diffFiles) {
-      diffFiles.forEach((item) => {
-        if (item.kind === 'D') {
-          deleteSet.push(item.path[0]);
-        }
-        if (item.kind === 'E') {
-          changeSet.push(item.path[0]);
-        }
-        if (item.kind === 'N') {
-          addSet.push(item.path[0]);
-        }
-      });
-    }
-    logger.info('Diff files', {
-      name: state.meta.name,
-      did: state.meta.did,
-      version: state.meta.version,
-      addNum: addSet.length,
-      changeNum: changeSet.length,
-      deleteNum: deleteSet.length,
-    });
-    return {
-      hasBlocklet: true,
-      version,
-      addSet,
-      changeSet,
-      deleteSet,
-    };
-  }
+    const rootDid = blocklet.meta.did;
 
-  async checkChildrenForUpdates({ did }) {
-    const blocklet = await this.state.getBlocklet(did);
-    const childrenMeta = await getChildrenMeta(blocklet.meta);
-    const updateList = getUpdateMetaList(
-      blocklet.children.map((x) => x.meta),
-      childrenMeta
-    );
+    const { children } = blocklet;
+    const component = children.find((x) => x.meta.did === did);
 
-    if (!updateList.length) {
-      return {};
+    if (!component) {
+      throw new Error('component does not exist');
     }
 
-    // start session
-    const { id: updateId } = await this.session.start({
-      did,
-      childrenMeta,
-    });
-
-    return {
-      updateId,
-      updateList,
-    };
-  }
-
-  async updateChildren({ updateId }, context) {
-    const { did, childrenMeta } = await this.session.end(updateId);
+    component.meta.title = title;
+    await states.blocklet.updateBlocklet(rootDid, { children });
 
-    // get old blocklet
-    const oldBlocklet = await this.state.getBlocklet(did);
-    const { meta } = oldBlocklet;
-    const { name, version } = meta;
+    // trigger meta.js refresh
+    // trigger dashboard frontend refresh
+    this.emit(BlockletEvents.updated, blocklet);
 
-    const action = 'upgrade';
+    return this.getBlocklet(rootDid);
+  }
 
-    logger.info(`${action} blocklet children`, {
-      did,
-      name,
-      version,
-      children: childrenMeta.map((x) => ({ name: x.name, version: x.version })),
-    });
+  async updateComponentMountPoint({ did, rootDid: inputRootDid, mountPoint: tmpMountPoint }, context) {
+    const mountPoint = await updateMountPointSchema.validateAsync(tmpMountPoint);
 
-    // new blocklet
-    const newBlocklet = await this.state.setBlockletStatus(did, BlockletStatus.waiting);
-    mergeMeta(meta, childrenMeta);
-    newBlocklet.meta = meta;
-    newBlocklet.children = await this.state.getChildrenFromMetas(childrenMeta);
-    await validateBlocklet(newBlocklet);
+    const blocklet = await states.blocklet.getBlocklet(inputRootDid);
 
-    this.emit(BlockletEvents.statusChange, newBlocklet);
+    if (!blocklet) {
+      throw new Error('blocklet does not exist');
+    }
 
-    // add to queue
-    const ticket = this.installQueue.push(
-      {
-        entity: 'blocklet',
-        action: 'download',
-        id: did,
-        oldBlocklet: { ...oldBlocklet },
-        blocklet: { ...newBlocklet },
-        version,
-        context,
-        postAction: action,
-      },
-      did
-    );
+    const rootDid = blocklet.meta.did;
 
-    ticket.on('failed', async (err) => {
-      logger.error('queue failed', { entity: 'blocklet', action, did, version, name, error: err });
-      await this._rollback(action, did, oldBlocklet);
-      this.emit(`blocklet.${action}.failed`, { did, version, err });
-      this.notification.create({
-        title: `Blocklet ${capitalize(action)} Failed`,
-        description: `Blocklet ${name}@${version} ${action} failed with error: ${err.message || 'queue exception'}`,
-        entityType: 'blocklet',
-        entityId: did,
-        severity: 'error',
-      });
-    });
-    return newBlocklet;
-  }
+    const isRootComponent = !did;
 
-  // ============================================================================================
-  // Internal API that are used by public APIs and called from CLI
-  // ============================================================================================
-  async dev(folder) {
-    logger.info('dev blocklet', { folder });
+    const component = isRootComponent ? blocklet : blocklet.children.find((x) => x.meta.did === did);
+    if (!component) {
+      throw new Error('component does not exist');
+    }
 
-    const meta = getBlockletMeta(folder);
-    if (meta.group !== 'static' && (!meta.scripts || !meta.scripts.dev)) {
-      throw new Error('Incorrect blocklet manifest: missing `scripts.dev` field');
+    if (isRootComponent && component.group === BlockletGroup.gateway) {
+      throw new Error('cannot update mountPoint of gateway blocklet');
     }
 
-    const { did, version } = meta;
-    meta.title = `[DEV] ${meta.title || meta.name}`;
+    checkDuplicateMountPoint(blocklet, mountPoint);
 
-    const exist = await this.state.getBlocklet(did);
-    if (exist) {
-      if (exist.mode === BLOCKLET_MODES.PRODUCTION) {
-        throw new Error('The blocklet of production mode already exists, please remove it before developing');
-      }
+    component.mountPoint = mountPoint;
 
-      const status = fromBlockletStatus(exist.status);
-      if (['starting', 'running'].includes(status)) {
-        throw new Error(`The blocklet is already on ${status}, please stop it before developing`);
-      }
+    await states.blocklet.updateBlocklet(rootDid, { mountPoint: blocklet.mountPoint, children: blocklet.children });
 
-      logger.info('remove blocklet for dev', { did, version });
+    this.emit(BlockletEvents.upgraded, { blocklet, context: { ...context, createAuditLog: false } }); // trigger router refresh
 
-      await this.delete({ did, keepLogsDir: false });
-    }
+    return this.getBlocklet(rootDid);
+  }
 
-    // delete process
-    try {
-      await this.deleteProcess({ did });
-      logger.info('delete blocklet precess for dev', { did, version });
-    } catch (err) {
-      logger.error('failed to delete blocklet process for dev', { error: err });
-    }
+  // eslint-disable-next-line no-unused-vars
+  async getRuntimeHistory({ did, hours }, context) {
+    const metaDid = await states.blocklet.getBlockletMetaDid(did);
 
-    const childrenMeta = await getChildrenMeta(meta);
-    mergeMeta(meta, childrenMeta);
-    const blocklet = await this.state.addBlocklet({
-      did,
-      meta,
-      source: BlockletSource.local,
-      deployedFrom: folder,
-      mode: BLOCKLET_MODES.DEVELOPMENT,
-      childrenMeta,
-    });
-    logger.info('add blocklet for dev', { did, version, meta });
+    const history = this.runtimeMonitor.getHistory(metaDid);
 
-    await this._downloadBlocklet(blocklet);
-    await this.state.setBlockletStatus(did, BlockletStatus.installed);
+    return getHistoryList({
+      history,
+      hours,
+      recordIntervalSec: MONITOR_RECORD_INTERVAL_SEC,
+      props: ['date', 'cpu', 'mem'],
+    });
+  }
 
-    // Add environments
-    await this._setConfigs(did);
-    await this.updateBlockletEnvironment(did);
+  async ensureBlocklet(did, opts = {}) {
+    return getBlocklet({ ...opts, states, dataDirs: this.dataDirs, did, ensureIntegrity: true });
+  }
 
-    this.emit(BlockletEvents.deployed, { blocklet, context: {} });
-    return this.ensureBlocklet(did);
+  async getBlocklet(did, opts = {}) {
+    return getBlocklet({ ...opts, states, dataDirs: this.dataDirs, did, ensureIntegrity: false });
   }
 
-  async ensureBlocklet(did) {
-    if (!isValidDid(did)) {
-      throw new Error(`Blocklet did is invalid: ${did}`);
-    }
+  async hasBlocklet({ did }) {
+    return states.blocklet.hasBlocklet(did);
+  }
 
-    const blocklet = await this.state.getBlocklet(did);
-    if (!blocklet) {
-      throw new Error(`Can not find blocklet in database by did ${did}`);
+  async setInitialized({ did, owner }) {
+    if (!validateOwner(owner)) {
+      throw new Error('Blocklet owner is invalid');
     }
 
-    blocklet.env = {
-      appId: blocklet.meta.name,
-      // dataDir is /dataDir.data/blocklet.meta.name
-      // cacheDir is /dataDirs.cache/blocklet.meta.name
-      // logDir is /dataDirs.log/blocklet.meta.name
-      ...getBlockletDirs(blocklet, {
-        dataDirs: this.dataDirs,
-        ensure: true,
-      }),
-    };
-
-    const configs = await this.extras.getConfigs(did);
-    fillBlockletConfigs(blocklet, configs);
-
-    // merge settings to blocklet
-    const settings = await this.extras.getSettings(did);
-    blocklet.trustedPassports = get(settings, 'trustedPassports') || [];
-    blocklet.enablePassportIssuance = get(settings, 'enablePassportIssuance', true);
-
-    // handle child env
-    for (const child of blocklet.children) {
-      const {
-        meta: { did: childDid, name: childName },
-      } = child;
-      const {
-        meta: { name },
-      } = blocklet;
-
-      child.env = {
-        appId: `${encodeURIComponent(name)}/${encodeURIComponent(childName)}`,
-        // dataDir is /dataDir.data/blocklet.meta.name/child.meta.name
-        // cacheDir is /dataDirs.cache/blocklet.meta.name/child.meta.name
-        // logDir is /dataDirs.log/blocklet.meta.name
-        ...getBlockletDirs(child, {
-          dataDirs: this.dataDirs,
-          ensure: true,
-          rootBlocklet: blocklet,
-        }),
-      };
+    const blocklet = await states.blocklet.getBlocklet(did);
+    await states.blockletExtras.setSettings(blocklet.meta.did, { initialized: true, owner });
+    logger.info('Blocklet initialized', { did, owner });
 
-      const childConfigs = await this.extras.getChildConfigs(did, childDid);
-      fillBlockletConfigs(child, childConfigs);
-    }
+    this.emit(BlockletEvents.updated, { meta: { did: blocklet.meta.did } });
 
-    return blocklet;
+    return this.getBlocklet(did);
   }
 
   async status(did, { forceSync = false } = {}) {
@@ -913,10 +1259,12 @@ class BlockletManager extends BaseBlockletManager {
         return blocklet;
       }
 
-      return this.state.setBlockletStatus(did, BlockletStatus.stopped);
+      const res = await states.blocklet.setBlockletStatus(did, BlockletStatus.stopped);
+      this.emit(BlockletEvents.statusChange, res);
+      return res;
     };
 
-    const blocklet = await this.ensureBlocklet(did);
+    const blocklet = await this.getBlocklet(did);
 
     let shouldUpdateStatus = forceSync || shouldUpdateBlockletStatus(blocklet.status);
     if (isInProgress(blocklet.status)) {
@@ -927,104 +1275,21 @@ class BlockletManager extends BaseBlockletManager {
       }
     }
 
-    try {
-      const status = await getBlockletStatusFromProcess(blocklet);
-      if (shouldUpdateStatus) {
-        if (status === BlockletStatus.stopped) {
-          await this.state.stopBlocklet(did);
-        }
-        return this.state.setBlockletStatus(did, status);
-      }
-    } catch (err) {
-      if (shouldUpdateStatus) {
-        return fastReturnOnForceSync(blocklet);
-      }
-      throw err;
-    }
-
-    return blocklet;
-  }
-
-  async getBlockletInterfaces({ blocklet, nodeInfo, context }) {
-    const routingRules = (await this.getRoutingRulesByDid(blocklet.meta.did)).sort((a, b) => {
-      // Put user-defined rules first
-      if (a.isProtected !== b.isProtected) {
-        return a.isProtected ? 1 : -1;
-      }
-      // Put shorter url first
-      return a.from.pathPrefix.length < b.from.pathPrefix ? 1 : -1;
-    });
-    const nodeIp = await getAccessibleExternalNodeIp(nodeInfo);
-    return getBlockletInterfaces({ blocklet, context, nodeInfo, routingRules, nodeIp });
-  }
-
-  async attachRuntimeInfo({ did, nodeInfo, diskInfo = true, context, cachedBlocklet }) {
-    if (!did) {
-      throw new Error('did should not be empty');
+    if (!shouldUpdateStatus) {
+      return blocklet;
     }
 
     try {
-      let blocklet = await this.ensureBlocklet(did);
-      const fromCache = !!cachedBlocklet;
-
-      // if from cached data, only use cache data of runtime info (engine, diskInfo, runtimeInfo...)
-      if (fromCache) {
-        blocklet = { ...cachedBlocklet, ...blocklet };
-      }
-
-      blocklet.interfaces = await this.getBlockletInterfaces({ blocklet, nodeInfo, context });
-
-      if (!fromCache) {
-        blocklet.engine = getEngine(getBlockletEngineNameByPlatform(blocklet.meta)).describe();
-        blocklet.diskInfo = await getDiskInfo(blocklet, { useFakeDiskInfo: !diskInfo });
-
-        try {
-          const { appId } = blocklet.meta.group === BlockletGroup.gateway ? blocklet.children[0].env : blocklet.env;
-          blocklet.runtimeInfo = await getRuntimeInfo(appId);
-          if (blocklet.runtimeInfo.status && shouldUpdateBlockletStatus(blocklet.status)) {
-            blocklet.status = statusMap[blocklet.runtimeInfo.status];
-          }
-        } catch (err) {
-          if (err.code !== 'BLOCKLET_PROCESS_404') {
-            logger.error('failed to construct blocklet runtime info', { did, error: err });
-          }
-
-          if (blocklet.status === BlockletStatus.running) {
-            await this.state.setBlockletStatus(did, BlockletStatus.stopped);
-            blocklet.status = BlockletStatus.stopped;
-          }
-        }
-
-        await Promise.all(
-          blocklet.children.map(async (child) => {
-            child.engine = getEngine(getBlockletEngineNameByPlatform(child.meta)).describe();
-            child.diskInfo = await getDiskInfo(child, {
-              useFakeDiskInfo: !diskInfo,
-            });
-            if (child.meta.group !== BlockletGroup.gateway) {
-              try {
-                child.runtimeInfo = await getRuntimeInfo(child.env.appId);
-                child.status = statusMap[blocklet.runtimeInfo.status];
-              } catch (err) {
-                if (err.code !== 'BLOCKLET_PROCESS_404') {
-                  logger.error('failed to construct blocklet runtime info', { did, error: err });
-                }
-              }
-            }
-          })
-        );
+      const status = await getBlockletStatusFromProcess(blocklet);
+      if (blocklet.status !== status) {
+        const res = await states.blocklet.setBlockletStatus(did, status);
+        this.emit(BlockletEvents.statusChange, res);
+        return res;
       }
 
       return blocklet;
     } catch (err) {
-      const simpleState = await this.state.getBlocklet(did);
-      logger.error('failed to get blocklet info', {
-        did,
-        name: get(simpleState, 'meta.name'),
-        status: get(simpleState, 'status'),
-        error: err,
-      });
-      return simpleState;
+      return fastReturnOnForceSync(blocklet);
     }
   }
 
@@ -1034,63 +1299,177 @@ class BlockletManager extends BaseBlockletManager {
     });
   }
 
+  async updateAllBlockletEnvironment() {
+    const blocklets = await states.blocklet.getBlocklets();
+    for (let i = 0; i < blocklets.length; i++) {
+      const blocklet = blocklets[i];
+      await this._updateBlockletEnvironment(blocklet.meta.did);
+    }
+  }
+
+  async prune() {
+    const blocklets = await states.blocklet.getBlocklets();
+    const settings = await states.blockletExtras.listSettings();
+    await pruneBlockletBundle({
+      installDir: this.dataDirs.blocklets,
+      blocklets,
+      blockletSettings: settings
+        .filter((x) => x.settings.children && x.settings.children.length)
+        .map((x) => x.settings),
+    });
+  }
+
   async onJob(job) {
     if (job.entity === 'blocklet') {
       if (job.action === 'download') {
-        await this.onDownload(job);
+        await this._downloadAndInstall(job);
       }
       if (job.action === 'restart') {
-        await this.onRestart(job);
+        await this._onRestart(job);
       }
 
       if (job.action === 'check_if_started') {
-        await this.onCheckIfStarted(job);
+        await this._onCheckIfStarted(job);
       }
     }
   }
 
-  async onDownload({ blocklet, context, postAction, oldBlocklet, throwOnError }) {
+  getCrons() {
+    return [
+      {
+        name: 'sync-blocklet-status',
+        time: '*/60 * * * * *', // 60s
+        fn: this._syncBlockletStatus.bind(this),
+      },
+      {
+        name: 'sync-blocklet-list',
+        time: '*/60 * * * * *', // 60s
+        fn: this.refreshListCache.bind(this),
+      },
+      {
+        name: 'refresh-accessible-ip',
+        time: '0 */10 * * * *', // 10min
+        fn: async () => {
+          const nodeInfo = await states.node.read();
+          await refreshAccessibleExternalNodeIp(nodeInfo);
+        },
+      },
+      {
+        name: 'delete-expired-external-blocklet',
+        time: '0 */30 * * * *', // 30min
+        options: { runOnInit: false },
+        fn: () => this._deleteExpiredExternalBlocklet(),
+      },
+      {
+        name: 'clean-expired-blocklet-data',
+        time: '0 */20 0 * * *', // 每天凌晨 0 点的每 20 分钟
+        fn: () => this._cleanExpiredBlockletData(),
+      },
+      {
+        name: 'record-blocklet-runtime-history',
+        time: `*/${MONITOR_RECORD_INTERVAL_SEC} * * * * *`, // 10s
+        fn: () => this.runtimeMonitor.monitAll(),
+      },
+    ];
+  }
+
+  // ============================================================================================
+  // Private API that are used by self of helper function
+  // ============================================================================================
+
+  /**
+   *
+   *
+   * @param {{
+   *  blocklet: {},
+   *  context: {},
+   *  postAction: 'install' | 'upgrade',
+   *  oldBlocklet: {},
+   *  throwOnError: Error,
+   *  skipCheckStatusBeforeDownload: boolean,
+   *  selectedComponentDids: Array<did>,
+   * }} params
+   * @return {*}
+   * @memberof BlockletManager
+   */
+  async _downloadAndInstall(params) {
+    const {
+      blocklet,
+      context,
+      postAction,
+      oldBlocklet,
+      throwOnError,
+      skipCheckStatusBeforeDownload,
+      selectedComponentDids,
+    } = params;
     const { meta } = blocklet;
     const { name, did, version } = meta;
 
-    try {
-      await preDownloadLock.acquire();
-
-      const b0 = await this.state.getBlocklet(did);
-      if (!b0 || ![BlockletStatus.waiting, BlockletStatus.downloading].includes(b0.status)) {
-        if (!b0) {
-          logger.error('blocklet does not exist before downloading', { name, did });
-        } else {
-          logger.error('blocklet status is invalid before downloading', {
-            name,
-            did,
-            status: fromBlockletStatus(b0.status),
-          });
+    // check status
+    if (!skipCheckStatusBeforeDownload) {
+      try {
+        await statusLock.acquire();
+
+        const b0 = await states.blocklet.getBlocklet(did);
+        if (!b0 || ![BlockletStatus.waiting].includes(b0.status)) {
+          if (!b0) {
+            throw new Error('blocklet does not exist before downloading');
+          } else {
+            throw new Error(`blocklet status is invalid before downloading: ${fromBlockletStatus(b0.status)}`);
+          }
         }
-        preDownloadLock.release();
+        statusLock.release();
+      } catch (error) {
+        statusLock.release();
+        logger.error('Check blocklet status failed before downloading', {
+          name,
+          did,
+          error,
+        });
         await this._rollback(postAction, did, oldBlocklet);
         return;
       }
+    }
 
-      const blocklet1 = await this.state.setBlockletStatus(did, BlockletStatus.downloading);
-      this.emit(BlockletEvents.statusChange, blocklet1);
-
-      preDownloadLock.release();
-
-      const { isCancelled } = await this._downloadBlocklet(blocklet, oldBlocklet);
+    // download bundle
+    try {
+      const blockletForDownload = {
+        ...blocklet,
+        children: (blocklet.children || []).filter((x) => {
+          if (selectedComponentDids?.length) {
+            return selectedComponentDids.includes(x.meta.did);
+          }
+          return x;
+        }),
+      };
+      const { isCancelled } = await this._downloadBlocklet(blockletForDownload, context);
 
       if (isCancelled) {
-        logger.info('Download was canceled manually', { name, did, version });
-        await this._rollback(postAction, did, oldBlocklet);
+        logger.info('Download was canceled', { name, did, version });
+
+        // rollback on download cancelled
+        await statusLock.acquire();
+        try {
+          if ((await states.blocklet.getBlockletStatus(did)) === BlockletStatus.downloading) {
+            await this._rollback(postAction, did, oldBlocklet);
+          }
+          statusLock.release();
+        } catch (error) {
+          statusLock.release();
+          logger.error('Rollback blocklet failed on download canceled', { postAction, name, did, version, error });
+        }
         return;
       }
     } catch (err) {
       logger.error('Download blocklet tarball failed', { name, did, version });
 
-      preDownloadLock.release();
-
-      this.emit(BlockletEvents.downloadFailed, { meta: did });
-      this.notification.create({
+      this.emit(BlockletEvents.downloadFailed, {
+        meta: { did },
+        error: {
+          message: err.message,
+        },
+      });
+      this._createNotification(did, {
         title: 'Blocklet Download Failed',
         description: `Blocklet ${name}@${version} download failed with error: ${err.message}`,
         entityType: 'blocklet',
@@ -1098,10 +1477,16 @@ class BlockletManager extends BaseBlockletManager {
         severity: 'error',
       });
 
+      // rollback on download failed
+      await statusLock.acquire();
       try {
-        await this._rollback(postAction, did, oldBlocklet);
-      } catch (e) {
-        logger.error('Rollback blocklet failed', { postAction, name, did, version });
+        if ((await states.blocklet.getBlockletStatus(did)) === BlockletStatus.downloading) {
+          await this._rollback(postAction, did, oldBlocklet);
+        }
+        statusLock.release();
+      } catch (error) {
+        statusLock.release();
+        logger.error('Rollback blocklet failed on download failed', { postAction, name, did, version, error });
       }
 
       if (throwOnError) {
@@ -1111,16 +1496,41 @@ class BlockletManager extends BaseBlockletManager {
       return;
     }
 
+    // update status
+    try {
+      await statusLock.acquire();
+
+      if ((await states.blocklet.getBlockletStatus(did)) !== BlockletStatus.downloading) {
+        throw new Error('blocklet status changed durning download');
+      }
+
+      if (postAction === 'install') {
+        const state = await states.blocklet.setBlockletStatus(did, BlockletStatus.installing);
+        this.emit(BlockletEvents.statusChange, state);
+      }
+
+      if (postAction === 'upgrade') {
+        const state = await states.blocklet.setBlockletStatus(did, BlockletStatus.upgrading);
+        this.emit(BlockletEvents.statusChange, state);
+      }
+
+      statusLock.release();
+    } catch (error) {
+      logger.error(error.message);
+      statusLock.release();
+    }
+
+    // install
     try {
       // install blocklet
       if (postAction === 'install') {
-        await this.onInstall({ blocklet, context });
+        await this._onInstall({ blocklet, context, oldBlocklet });
         return;
       }
 
       // upgrade blocklet
-      if (['upgrade', 'downgrade'].includes(postAction)) {
-        await this.onUpgrade({ oldBlocklet, newBlocklet: blocklet, action: postAction, context });
+      if (postAction === 'upgrade') {
+        await this._onUpgrade({ oldBlocklet, newBlocklet: blocklet, context });
       }
     } catch (error) {
       if (throwOnError) {
@@ -1129,26 +1539,27 @@ class BlockletManager extends BaseBlockletManager {
     }
   }
 
-  async onInstall({ blocklet, context }) {
+  async _onInstall({ blocklet, context, oldBlocklet }) {
     const { meta } = blocklet;
     const { did, version } = meta;
     logger.info('do install blocklet', { did, version });
 
-    const state = await this.state.setBlockletStatus(did, BlockletStatus.installing);
-    this.emit(BlockletEvents.statusChange, state);
-
     try {
-      await this._installBlocklet({
+      const installedBlocklet = await this._installBlocklet({
         did,
         context,
+        oldBlocklet,
       });
 
       if (context.startImmediately) {
-        try {
-          logger.info('start blocklet after installed', { did });
-          await this.start({ did, checkHealthImmediately: true });
-        } catch (error) {
-          logger.warn('attempt to start immediately failed', { did, error });
+        const missingProps = getAppMissingConfigs(installedBlocklet);
+        if (!missingProps.length) {
+          try {
+            logger.info('start blocklet after installed', { did });
+            await this.start({ did, checkHealthImmediately: true });
+          } catch (error) {
+            logger.warn('attempt to start immediately failed', { did, error });
+          }
         }
       }
     } catch (err) {
@@ -1156,12 +1567,9 @@ class BlockletManager extends BaseBlockletManager {
     }
   }
 
-  async onUpgrade({ oldBlocklet, newBlocklet, action, context }) {
+  async _onUpgrade({ oldBlocklet, newBlocklet, context }) {
     const { version, did } = newBlocklet.meta;
-    logger.info(`do ${action} blocklet`, { did, version });
-
-    const state = await this.state.setBlockletStatus(did, BlockletStatus.upgrading);
-    this.emit(BlockletEvents.statusChange, state);
+    logger.info('do upgrade blocklet', { did, version });
 
     try {
       await this._upgradeBlocklet({
@@ -1174,15 +1582,17 @@ class BlockletManager extends BaseBlockletManager {
     }
   }
 
-  async onRestart({ did, context }) {
+  async _onRestart({ did, context }) {
     await this.stop({ did, updateStatus: false }, context);
     await this.start({ did }, context);
   }
 
-  async onCheckIfStarted(jobInfo, { throwOnError } = {}) {
-    const { blocklet, context, minConsecutiveTime = 5000, timeout } = jobInfo;
+  async _onCheckIfStarted(jobInfo, { throwOnError } = {}) {
+    const { did, context, minConsecutiveTime = 5000, timeout } = jobInfo;
+    const blocklet = await this.getBlocklet(did);
+
     const { meta } = blocklet;
-    const { did, name } = meta;
+    const { name } = meta;
 
     try {
       // healthy check
@@ -1192,12 +1602,18 @@ class BlockletManager extends BaseBlockletManager {
       const res = await this.status(did, { forceSync: true });
       this.emit(BlockletEvents.started, res);
     } catch (error) {
+      const status = await states.blocklet.getBlockletStatus(did);
+      if ([BlockletStatus.stopping, BlockletStatus.stopped].includes(status)) {
+        logger.info(`Check blocklet healthy failing because blocklet is ${fromBlockletStatus(status)}`);
+        return;
+      }
+
       logger.error('check blocklet if started failed', { did, name, context, timeout, error });
 
       await this.deleteProcess({ did }, context);
-      await this.state.setBlockletStatus(did, BlockletStatus.error);
+      await states.blocklet.setBlockletStatus(did, BlockletStatus.error);
 
-      this.notification.create({
+      this._createNotification(did, {
         title: 'Blocklet Start Failed',
         description: `Blocklet ${name} start failed: ${error.message}`,
         entityType: 'blocklet',
@@ -1213,620 +1629,212 @@ class BlockletManager extends BaseBlockletManager {
     }
   }
 
-  async updateBlockletEnvironment(did) {
-    const blockletWithEnv = await this.ensureBlocklet(did);
-    const blocklet = await this.state.getBlocklet(did);
-    const nodeInfo = await this.node.read();
+  async _updateBlockletEnvironment(did) {
+    const blockletWithEnv = await this.getBlocklet(did);
+    const blocklet = await states.blocklet.getBlocklet(did);
+    const nodeInfo = await states.node.read();
 
-    const rootSystemEnvironments = getRootSystemEnvironments(blockletWithEnv, nodeInfo);
-    const rootConfig = blockletWithEnv.configObj;
-    const overwrittenEnvironments = getOverwrittenEnvironments(blockletWithEnv, nodeInfo);
+    const appSystemEnvironments = {
+      ...getAppSystemEnvironments(blockletWithEnv, nodeInfo),
+      ...getAppOverwrittenEnvironments(blockletWithEnv, nodeInfo),
+    };
 
-    // fill environments to blocklet and blocklet.children
+    // fill environments to blocklet and components
     blocklet.environments = formatEnvironments({
-      ...rootConfig,
-      ...getSystemEnvironments(blockletWithEnv),
-      ...rootSystemEnvironments,
-      ...overwrittenEnvironments,
+      ...getComponentSystemEnvironments(blockletWithEnv),
+      ...appSystemEnvironments,
     });
 
-    for (const child of blocklet.children) {
-      const childWithEnv = blockletWithEnv.children.find((x) => x.meta.did === child.meta.did);
+    const envMap = {};
+    forEachBlockletSync(blockletWithEnv, (child, { ancestors }) => {
+      const id = getComponentId(child, ancestors);
+      envMap[id] = child;
+    });
+
+    forEachChildSync(blocklet, (child, { ancestors }) => {
+      const id = getComponentId(child, ancestors);
+
+      const childWithEnv = envMap[id];
       if (childWithEnv) {
-        const childConfig = childWithEnv.configObj;
         child.environments = formatEnvironments({
-          ...childConfig, // custom env of child blocklet
-          ...rootConfig, // // custom env of root blocklet FIXME: use options or hooks to make merge logic flexible
-          ...getSystemEnvironments(childWithEnv), // system env of child blocklet
-          ...rootSystemEnvironments, // system env of root blocklet
-          ...overwrittenEnvironments,
+          ...getComponentSystemEnvironments(childWithEnv), // system env of child blocklet
+          ...appSystemEnvironments, // system env of root blocklet
         });
       }
-    }
+    });
 
-    // update state to db
-    return this.state.updateById(blocklet._id, blocklet);
-  }
-
-  async updateAllBlockletEnvironment() {
-    const blocklets = await this.state.getBlocklets();
-    for (let i = 0; i < blocklets.length; i++) {
-      const blocklet = blocklets[i];
-      await this.updateBlockletEnvironment(blocklet.meta.did);
-    }
-  }
-
-  async _installFromRegistry({ did, registry }, context) {
-    logger.debug('start install blocklet', { did });
-    if (!isValidDid(did)) {
-      throw new Error('Blocklet did is invalid');
-    }
+    // put BLOCKLET_APP_ID at root level for indexing
+    blocklet.appDid = appSystemEnvironments.BLOCKLET_APP_ID;
 
-    const registryUrl = registry || (await states.node.getBlockletRegistry());
-    const info = await BlockletRegistry.getRegistryMeta(registryUrl);
-    const blocklet = await this.registry.getBlocklet(did, registryUrl);
-    if (!blocklet) {
-      throw new Error('Can not install blocklet that not found in registry');
+    if (!Array.isArray(blocklet.migratedFrom)) {
+      blocklet.migratedFrom = [];
     }
-
-    const state = await this.state.getBlocklet(blocklet.did);
-    if (state) {
-      throw new Error('Can not install an already installed blocklet');
-    }
-
-    if (isFreeBlocklet(blocklet) === false && !context.blockletPurchaseVerified) {
-      throw new Error('Can not install a non-free blocklet directly');
+    // This can only be set once, can be used for indexing, will not change ever
+    if (!blocklet.appPid) {
+      blocklet.appPid = appSystemEnvironments.BLOCKLET_APP_PID;
     }
 
-    // install
-    return this._install({
-      meta: blocklet,
-      source: BlockletSource.registry,
-      deployedFrom: info.cdnUrl || registryUrl,
-      context,
-    });
+    // update state to db
+    return states.blocklet.updateBlocklet(did, blocklet);
   }
 
-  async _installFromUrl({ url, sync }, context) {
-    logger.debug('start install blocklet', { url });
-
-    const meta = await getBlockletMetaFromUrl(url);
-
-    if (!meta) {
-      throw new Error(`Can not install blocklet that not found by url: ${url}`);
+  async _attachRuntimeInfo({ did, nodeInfo, diskInfo = true, context, cachedBlocklet }) {
+    if (!did) {
+      throw new Error('did should not be empty');
     }
 
-    // upgrade
-    const exist = await this.state.getBlocklet(meta.did);
-    if (exist) {
-      return this._upgrade({
-        meta,
-        source: BlockletSource.url,
-        deployedFrom: url,
-        sync,
-        context,
-      });
-    }
+    try {
+      const blocklet = await this.getBlocklet(did, { throwOnNotExist: false });
 
-    // install
-    return this._install({
-      meta,
-      source: BlockletSource.url,
-      deployedFrom: url,
-      sync,
-      context,
-    });
-  }
+      if (!blocklet) {
+        return null;
+      }
 
-  async _installFromUpload({ file, did, diffVersion, deleteSet, context }) {
-    logger.info('install blocklet', { from: 'upload file' });
-    // download
-    // const { filename, mimetype, encoding, createReadStream } = await file;
-    const { filename, createReadStream } = await file;
-    const cwd = path.join(this.dataDirs.tmp, 'download');
-    const tarFile = path.join(cwd, `${path.basename(filename, path.extname(filename))}.tgz`);
-    await fs.ensureDir(cwd);
-    await new Promise((resolve, reject) => {
-      const readStream = createReadStream();
-      const writeStream = fs.createWriteStream(tarFile);
-      readStream
-        .pipe(new Throttle({ rate: 1024 * 1024 * 20 })) // 20MB
-        .pipe(writeStream);
-      readStream.on('error', (error) => {
-        logger.error('File upload read stream failed', { error });
-        writeStream.destroy(new Error('File upload read stream failed'));
-      });
-      writeStream.on('error', (error) => {
-        logger.error('File upload write stream failed', { error });
-        fs.removeSync(tarFile);
-        reject(error);
-      });
-      writeStream.on('finish', resolve);
-    });
+      const fromCache = !!cachedBlocklet;
 
-    // diff deploy
-    if (did && diffVersion) {
-      const oldBlocklet = await this.state.getBlocklet(did);
-      if (!oldBlocklet) {
-        throw new Error(`Blocklet ${did} not found when diff deploying`);
-      }
-      if (oldBlocklet.meta.version !== diffVersion) {
-        logger.error('Diff deploy: Blocklet version changed', {
-          preVersion: diffVersion,
-          changedVersion: oldBlocklet.meta.version,
-          name: oldBlocklet.meta.name,
-          did: oldBlocklet.meta.did,
+      // if from cached data, only use cache data of runtime info (engine, diskInfo, runtimeInfo...)
+      if (fromCache) {
+        const cached = {};
+        forEachBlockletSync(cachedBlocklet, (component, { id }) => {
+          cached[id] = component;
         });
-        throw new Error('Blocklet version changed when diff deploying');
-      }
-      if (isInProgress(oldBlocklet.status)) {
-        logger.error(`Can not deploy blocklet when it is ${fromBlockletStatus(oldBlocklet.status)}`);
-        throw new Error(`Can not deploy blocklet when it is ${fromBlockletStatus(oldBlocklet.status)}`);
-      }
-
-      const { meta } = await this._resolveDiffDownload(cwd, tarFile, deleteSet, oldBlocklet);
-      const childrenMeta = await getChildrenMeta(meta);
-      mergeMeta(meta, childrenMeta);
-      const newBlocklet = await this.state.getBlocklet(did);
-      newBlocklet.meta = meta;
-      newBlocklet.source = BlockletSource.upload;
-      newBlocklet.deployedFrom = `Upload by ${context.user.did}`;
-      newBlocklet.children = await this.state.getChildrenFromMetas(childrenMeta);
-      await validateBlocklet(newBlocklet);
-      await this._downloadBlocklet(newBlocklet, oldBlocklet);
-
-      return this._upgradeBlocklet({
-        oldBlocklet,
-        newBlocklet,
-        context,
-      });
-    }
 
-    // full deploy
-    const { meta } = await this._resolveDownload(cwd, tarFile);
-    const oldBlocklet = await this.state.getBlocklet(meta.did);
+        Object.assign(blocklet, pick(cachedBlocklet, ['appRuntimeInfo', 'diskInfo']));
 
-    if (oldBlocklet) {
-      if (isInProgress(oldBlocklet.status)) {
-        logger.error(`Can not deploy blocklet when it is ${fromBlockletStatus(oldBlocklet.status)}`);
-        throw new Error(`Can not deploy blocklet when it is ${fromBlockletStatus(oldBlocklet.status)}`);
+        forEachBlockletSync(blocklet, (component, { id }) => {
+          if (cached[id]) {
+            Object.assign(component, pick(cached[id], ['runtimeInfo']));
+          }
+        });
       }
 
-      const childrenMeta = await getChildrenMeta(meta);
-      mergeMeta(meta, childrenMeta);
-      const newBlocklet = await this.state.getBlocklet(meta.did);
-      newBlocklet.meta = meta;
-      newBlocklet.source = BlockletSource.upload;
-      newBlocklet.deployedFrom = `Upload by ${context.user.did}`;
-      newBlocklet.children = await this.state.getChildrenFromMetas(childrenMeta);
-
-      await validateBlocklet(newBlocklet);
-      await this._downloadBlocklet(newBlocklet, oldBlocklet);
-
-      return this._upgradeBlocklet({
-        oldBlocklet,
-        newBlocklet,
-        context,
-      });
-    }
-
-    const childrenMeta = await getChildrenMeta(meta);
-    mergeMeta(meta, childrenMeta);
-    const blocklet = await this.state.addBlocklet({
-      did: meta.did,
-      meta,
-      source: BlockletSource.upload,
-      deployedFrom: `Upload by ${context.user.did}`,
-      childrenMeta,
-    });
-
-    await validateBlocklet(blocklet);
-
-    await this._setConfigs(meta.did);
-
-    // download
-    await this._downloadBlocklet(blocklet);
-    return this._installBlocklet({
-      did: meta.did,
-      context,
-    });
-  }
-
-  /**
-   * add to download job queue
-   * @param {string} did blocklet did
-   * @param {object} blocklet object
-   */
-  async download(did, blocklet) {
-    await this.state.setBlockletStatus(did, BlockletStatus.waiting);
-    this.installQueue.push(
-      {
-        entity: 'blocklet',
-        action: 'download',
-        id: did,
-        blocklet: { ...blocklet },
-        postAction: 'install',
-      },
-      did
-    );
-  }
-
-  async getStatus(did) {
-    if (!did) {
-      throw new Error('did is required');
-    }
-
-    const blocklet = await this.state.findOne({ 'meta.did': did }, { meta: 1, status: 1 });
-    if (!blocklet) {
-      return null;
-    }
-
-    return { name: blocklet.meta.name, did: blocklet.meta.did, status: blocklet.status };
-  }
-
-  async prune() {
-    const blocklets = await this.state.getBlocklets();
-    await pruneBlockletBundle(blocklets, this.dataDirs.blocklets);
-  }
-
-  async getLatestBlockletVersion({ did, version }) {
-    const blocklet = await this.state.getBlocklet(did);
-    if (!blocklet) {
-      throw new Error('the blocklet is not installed');
-    }
-
-    let versions = this.cachedBlockletVersions.get(did);
+      // 处理 domainAliases#value SLOT_FOR_IP_DNS_SITE
+      if (blocklet?.site?.domainAliases?.length) {
+        const nodeIp = await getAccessibleExternalNodeIp(nodeInfo);
+        blocklet.site.domainAliases = blocklet.site.domainAliases.map((x) => ({
+          ...x,
+          value: util.replaceDomainSlot({ domain: x.value, context, nodeIp }),
+        }));
+      }
 
-    if (!versions) {
-      const { blockletRegistryList } = await this.node.read();
-      const tasks = blockletRegistryList.map((registry) =>
-        this.registry
-          .getBlockletMeta({ did, registryUrl: registry.url })
-          .then((item) => ({ did, version: item.version, registryUrl: registry.url }))
-          .catch((error) => {
-            if (error.response && error.response.status === 404) {
-              return;
-            }
-            logger.error('get blocklet meta from registry failed', { did, error });
-          })); // prettier-ignore
+      // app runtime info, app status
+      blocklet.appRuntimeInfo = this.runtimeMonitor.getRuntimeInfo(blocklet.meta.did);
 
-      versions = await Promise.all(tasks);
-      this.cachedBlockletVersions.set(did, versions);
-    }
+      if (!fromCache) {
+        // app disk info, component runtime info, component status, component engine
+        await forEachBlocklet(blocklet, async (component, { level }) => {
+          component.engine = getEngine(getBlockletEngineNameByPlatform(component.meta)).describe();
 
-    versions = versions.filter((item) => item && semver.gt(item.version, version));
+          if (level === 0) {
+            component.diskInfo = await getDiskInfo(component, {
+              useFakeDiskInfo: !diskInfo,
+            });
+          }
 
-    if (versions.length === 0) {
-      return null;
-    }
+          component.runtimeInfo = this.runtimeMonitor.getRuntimeInfo(blocklet.meta.did, component.env.id);
 
-    let latestBlockletVersion = versions[0];
-    versions.forEach((item) => {
-      if (semver.lt(latestBlockletVersion.version, item.version)) {
-        latestBlockletVersion = item;
+          if (component.runtimeInfo?.status && shouldUpdateBlockletStatus(component.status)) {
+            component.status = statusMap[component.runtimeInfo.status];
+          }
+        });
       }
-    });
-
-    return latestBlockletVersion;
-  }
 
-  getCrons() {
-    return [
-      {
-        name: 'sync-blocklet-status',
-        time: '*/60 * * * * *', // 60s
-        fn: this._syncBlockletStatus.bind(this),
-      },
-      {
-        name: 'sync-blocklet-list',
-        time: '*/60 * * * * *', // 60s
-        fn: this.refreshListCache.bind(this),
-      },
-      {
-        name: 'refresh-accessible-ip',
-        time: '0 */10 * * * *', // 10min
-        fn: async () => {
-          const nodeInfo = await this.node.read();
-          await refreshAccessibleExternalNodeIp(nodeInfo);
-        },
-      },
-    ];
+      return blocklet;
+    } catch (err) {
+      const simpleState = await states.blocklet.getBlocklet(did);
+      logger.error('failed to get blocklet info', {
+        did,
+        name: get(simpleState, 'meta.name'),
+        status: get(simpleState, 'status'),
+        error: err,
+      });
+      return simpleState;
+    }
   }
 
   async _syncBlockletStatus() {
     const run = async (blocklet) => {
       try {
-        await this.status(blocklet.meta.did, { forceSync: true });
+        await this.status(blocklet.meta.did);
       } catch (err) {
         logger.error('sync blocklet status failed', { error: err });
       }
     };
-    const blocklets = await this.state.getBlocklets();
+    const blocklets = await states.blocklet.getBlocklets();
     blocklets.forEach(run);
   }
 
-  async _install({ meta, source, deployedFrom, context, sync }) {
-    validateBlockletMeta(meta, { ensureDist: true });
-
-    const { name, did, version } = meta;
-
-    const childrenMeta = await getChildrenMeta(meta);
-    mergeMeta(meta, childrenMeta);
-    try {
-      const blocklet = await this.state.addBlocklet({
-        did: meta.did,
-        meta,
-        source,
-        deployedFrom,
-        childrenMeta,
-      });
-
-      await validateBlocklet(blocklet);
-
-      await this._setConfigs(did);
-
-      logger.info('blocklet added to database', { meta });
-
-      const blocklet1 = await this.state.setBlockletStatus(did, BlockletStatus.waiting);
-      this.emit(BlockletEvents.added, blocklet1);
-
-      // download
-      const downloadParams = {
-        blocklet: { ...blocklet1 },
-        context,
-        postAction: 'install',
-      };
-
-      if (sync) {
-        await this.onDownload({ ...downloadParams, throwOnError: true });
-        return this.state.getBlocklet(did);
-      }
-
-      const ticket = this.installQueue.push(
-        {
-          entity: 'blocklet',
-          action: 'download',
-          id: did,
-          ...downloadParams,
-        },
-        did
-      );
-      ticket.on('failed', async (err) => {
-        logger.error('failed to install blocklet', { name, did, version, error: err });
-        try {
-          await this._delExtras(did);
-          await this.state.deleteBlocklet(did);
-        } catch (e) {
-          logger.error('failed to remove blocklet on install error', { did: meta.did, error: e });
-        }
-
-        this.notification.create({
-          title: 'Blocklet Install Failed',
-          description: `Blocklet ${name}@${version} install failed with error: ${err.message || 'queue exception'}`,
-          entityType: 'blocklet',
-          entityId: did,
-          severity: 'error',
-        });
-      });
-
-      return blocklet1;
-    } catch (err) {
-      logger.error('failed to install blocklet', { name, did, version, error: err });
-      this.notification.create({
-        title: 'Blocklet Install Failed',
-        description: `Blocklet ${name}@${version} install failed with error: ${err.message || 'queue exception'}`,
-        entityType: 'blocklet',
-        entityId: did,
-        severity: 'error',
-      });
-
-      try {
-        await this._rollback('install', did);
-      } catch (e) {
-        logger.error('failed to remove blocklet on install error', { did: meta.did, error: e });
-      }
-
-      throw err;
+  async _getChildrenForInstallation(component) {
+    if (!component) {
+      return [];
     }
-  }
-
-  async _upgrade({ meta, source, deployedFrom, context, sync }) {
-    validateBlockletMeta(meta, { ensureDist: true });
-
-    const { name, version, did } = meta;
-
-    const oldBlocklet = await this.state.getBlocklet(did);
-
-    // NOTE: 目前的版本移除了降级通道，所以不需要考虑降级通道的情况
-    const action = semver.gt(oldBlocklet.meta.version, version) ? 'downgrade' : 'upgrade';
-    logger.info(`${action} blocklet`, { did, version });
-
-    const newBlocklet = await this.state.setBlockletStatus(did, BlockletStatus.waiting);
-    const childrenMeta = await getChildrenMeta(meta);
-    mergeMeta(meta, childrenMeta);
-    newBlocklet.meta = meta;
-    newBlocklet.source = source;
-    newBlocklet.deployedFrom = deployedFrom;
-    newBlocklet.children = await this.state.getChildrenFromMetas(childrenMeta);
-
-    await validateBlocklet(newBlocklet);
-
-    this.emit(BlockletEvents.statusChange, newBlocklet);
 
-    // download
-    const downloadParams = {
-      oldBlocklet: { ...oldBlocklet },
-      blocklet: { ...newBlocklet },
-      version,
-      context,
-      postAction: action,
-    };
-
-    if (sync) {
-      await this.onDownload({ ...downloadParams, throwOnError: true });
-      return this.state.getBlocklet(did);
+    const { dynamicComponents } = await parseComponents(component);
+    if (component.meta.group !== BlockletGroup.gateway) {
+      dynamicComponents.unshift(component);
     }
 
-    const ticket = this.installQueue.push(
-      {
-        entity: 'blocklet',
-        action: 'download',
-        id: did,
-        ...downloadParams,
-      },
-      did
-    );
-
-    ticket.on('failed', async (err) => {
-      logger.error('queue failed', { entity: 'blocklet', action, did, version, name, error: err });
-      await this._rollback(action, did, oldBlocklet);
-      this.emit(`blocklet.${action}.failed`, { did, version, err });
-      this.notification.create({
-        title: `Blocklet ${capitalize(action)} Failed`,
-        description: `Blocklet ${name}@${version} ${action} failed with error: ${err.message || 'queue exception'}`,
-        entityType: 'blocklet',
-        entityId: did,
-        severity: 'error',
-      });
-    });
-    return newBlocklet;
+    const children = filterDuplicateComponents(dynamicComponents);
+    checkVersionCompatibility(children);
+    return children;
   }
 
-  /**
-   * decompress file, format dir and move to installDir
-   * @param {string} cwd
-   * @param {string} tarFile
-   * @param {object} originalMeta for verification
-   * @param {object} option
-   */
-  async _resolveDownload(cwd, tarFile, originalMeta, { removeTarFile = true } = {}) {
-    const downloadDir = path.join(cwd, `${path.basename(tarFile, path.extname(tarFile))}`);
-    const tmp = `${downloadDir}-tmp`;
-    try {
-      await expandTarball({ source: tarFile, dest: tmp, strip: 0 });
-    } catch (error) {
-      logger.error('expand blocklet tar file error');
-      throw error;
-    } finally {
-      if (removeTarFile) {
-        fs.removeSync(tarFile);
-      }
-    }
-    let installDir;
-    let meta;
-    try {
-      // resolve dir
-      let dir = tmp;
-      const files = await asyncFs.readdir(dir);
-      if (files.includes('package')) {
-        dir = path.join(tmp, 'package');
-      } else if (files.length === 1) {
-        const d = path.join(dir, files[0]);
-        if ((await asyncFs.stat(d)).isDirectory()) {
-          dir = d;
-        }
-      }
-
-      if (fs.existsSync(path.join(dir, BLOCKLET_BUNDLE_FOLDER))) {
-        dir = path.join(dir, BLOCKLET_BUNDLE_FOLDER);
-      }
-
-      logger.info('Move downloadDir to installDir', { downloadDir });
-      await fs.move(dir, downloadDir, { overwrite: true });
-      fs.removeSync(tmp);
-
-      meta = getBlockletMeta(downloadDir, { ensureMain: true });
-      const { did, name, version } = meta;
-
-      // validate
-      if (
-        originalMeta &&
-        (originalMeta.did !== did || originalMeta.name !== name || originalMeta.version !== version)
-      ) {
-        logger.error('Meta has differences', { originalMeta, meta });
-        throw new Error('There are differences between the meta from tarball file and the original meta');
-      }
-      await validateBlockletEntry(downloadDir, meta);
+  async _addBlocklet({ component, mode = BLOCKLET_MODES.PRODUCTION, name, did, title, description }) {
+    const meta = {
+      name,
+      did,
+      title: title || component?.meta?.title || '',
+      description: description || component?.meta?.description || '',
+      version: BLOCKLET_DEFAULT_VERSION,
+      group: BlockletGroup.gateway,
+      interfaces: [
+        {
+          type: BLOCKLET_INTERFACE_TYPE_WEB,
+          name: BLOCKLET_INTERFACE_PUBLIC,
+          path: BLOCKLET_DEFAULT_PATH_REWRITE,
+          prefix: BLOCKLET_DYNAMIC_PATH_PREFIX,
+          port: BLOCKLET_DEFAULT_PORT_NAME,
+          protocol: BLOCKLET_INTERFACE_PROTOCOL_HTTP,
+        },
+      ],
+      specVersion: BLOCKLET_LATEST_SPEC_VERSION,
+      environments: component?.meta?.environments || [],
+      timeout: {
+        start: process.env.NODE_ENV === 'test' ? 10 : 60,
+      },
+    };
 
-      await ensureBlockletExpanded(meta, downloadDir);
+    const children = component ? await this._getChildrenForInstallation(component) : [];
 
-      installDir = path.join(this.installDir, name, version);
-      if (fs.existsSync(installDir)) {
-        fs.removeSync(installDir);
-        logger.info('cleanup blocklet upgrade dir', { name, version, installDir });
-      } else {
-        fs.mkdirSync(installDir, { recursive: true });
-      }
-      await fs.move(downloadDir, installDir, { overwrite: true });
-    } catch (error) {
-      fs.removeSync(downloadDir);
-      fs.removeSync(tmp);
-      throw error;
+    if (children[0]?.meta?.logo) {
+      meta.logo = children[0].meta.logo;
     }
 
-    return { meta, installDir };
-  }
-
-  async _resolveDiffDownload(cwd, tarFile, deleteSet, blocklet) {
-    logger.info('Resolve diff download', { tarFile, cwd });
-    const downloadDir = path.join(cwd, `${path.basename(tarFile, path.extname(tarFile))}`);
-    const diffDir = `${downloadDir}-diff`;
-    try {
-      await expandTarball({ source: tarFile, dest: diffDir, strip: 0 });
-      fs.removeSync(tarFile);
-    } catch (error) {
-      fs.removeSync(tarFile);
-      logger.error('expand blocklet tar file error');
-      throw error;
-    }
-    logger.info('Copy installDir to downloadDir', { installDir: this.installDir, downloadDir });
-    await fs.copy(path.join(this.installDir, blocklet.meta.name, blocklet.meta.version), downloadDir);
-    try {
-      // delete
-      logger.info('Delete files from downloadDir', { fileNum: deleteSet.length });
-      // eslint-disable-next-line no-restricted-syntax
-      for (const file of deleteSet) {
-        await fs.remove(path.join(downloadDir, file));
-      }
-      // walk & cover
-      logger.info('Move files from diffDir to downloadDir', { diffDir, downloadDir });
-      const walkDiff = async (dir) => {
-        const files = await asyncFs.readdir(dir);
-        // eslint-disable-next-line no-restricted-syntax
-        for (const file of files) {
-          const p = path.join(dir, file);
-          const stat = await asyncFs.stat(p);
-          if (stat.isDirectory()) {
-            await walkDiff(p);
-          } else if (stat.isFile()) {
-            await fs.move(p, path.join(downloadDir, path.relative(diffDir, p)), { overwrite: true });
-          }
-        }
-      };
-      await walkDiff(diffDir);
-      fs.removeSync(diffDir);
-      const meta = getBlockletMeta(downloadDir, { ensureMain: true });
+    await validateBlocklet({ meta, children });
 
-      await ensureBlockletExpanded(meta, downloadDir);
+    // fake install bundle
+    const bundleDir = getBundleDir(this.installDir, meta);
+    fs.mkdirSync(bundleDir, { recursive: true });
+    updateMetaFile(path.join(bundleDir, BLOCKLET_META_FILE), meta);
 
-      const installDir = path.join(this.installDir, meta.name, meta.version);
-      logger.info('Move downloadDir to installDir', { downloadDir, installDir });
-      await fs.move(downloadDir, installDir, { overwrite: true });
+    // add blocklet to db
+    const blocklet = await states.blocklet.addBlocklet({
+      meta,
+      source: BlockletSource.custom,
+      children,
+      mode,
+    });
 
-      return { meta, installDir };
-    } catch (error) {
-      fs.removeSync(downloadDir);
-      fs.removeSync(diffDir);
-      throw error;
-    }
+    return blocklet;
   }
 
   /**
    * @param {string} opt.did
    * @param {object} opt.context
    */
-  async _installBlocklet({ did, context }) {
+  async _installBlocklet({ did, oldBlocklet, context, createNotification = true }) {
     try {
+      // should ensure blocklet integrity
       let blocklet = await this.ensureBlocklet(did);
       const { meta, source, deployedFrom } = blocklet;
 
@@ -1839,58 +1847,82 @@ class BlockletManager extends BaseBlockletManager {
       }
 
       // pre install
-      const nodeEnvironments = await this.node.getEnvironments();
-      const preInstall = (b) =>
-        hooks.preInstall({
-          hooks: Object.assign(b.meta.hooks || {}, b.meta.scripts || {}),
-          env: { ...nodeEnvironments },
-          appDir: blocklet.env.appDir,
-          did, // root blocklet did
-          notification: this.notification,
-          context,
-        });
-      await forEachBlocklet(blocklet, preInstall, { parallel: true });
+      await this._runPreInstallHook(blocklet, context);
 
       // Add environments
-      await this.updateBlockletEnvironment(meta.did);
-      blocklet = await this.ensureBlocklet(did);
+      await this._updateBlockletEnvironment(meta.did);
+      blocklet = await this.getBlocklet(did);
 
       // post install
-      const postInstall = (b) =>
-        hooks.postInstall({
-          hooks: Object.assign(b.meta.hooks || {}, b.meta.scripts || {}),
-          env: getRuntimeEnvironments(b, nodeEnvironments),
-          appDir: blocklet.env.appDir,
-          did, // root blocklet did
-          notification: this.notification,
-          context,
+      await this._runPostInstallHook(blocklet, context);
+
+      await states.blocklet.setBlockletStatus(did, BlockletStatus.installed);
+      blocklet = await this.getBlocklet(did);
+      logger.info('blocklet installed', { source, did: meta.did });
+
+      // logo
+      if (blocklet.children[0]?.meta?.logo) {
+        const fileName = blocklet.children[0].meta.logo;
+        const src = path.join(getBundleDir(this.installDir, blocklet.children[0].meta), fileName);
+        const dist = path.join(getBundleDir(this.installDir, blocklet.meta), fileName);
+        await fs.copy(src, dist);
+      }
+
+      await fs.writeFile(path.join(blocklet.env.dataDir, 'logo.svg'), createDidLogo(blocklet.meta.did));
+
+      // Init db
+      await this.teamManager.initTeam(blocklet.meta.did);
+
+      // Update dependents
+      await this._updateDependents(did);
+      blocklet = await this.getBlocklet(did);
+
+      this.emit(BlockletEvents.installed, { blocklet, context });
+
+      // Update dynamic component meta in blocklet settings
+      await this._ensureDeletedChildrenInSettings(blocklet);
+
+      if (context?.downloadTokenList?.length) {
+        await states.blocklet.updateBlocklet(did, {
+          tokens: {
+            downloadTokenList: context.downloadTokenList,
+          },
+        });
+      }
+
+      if (blocklet.controller && process.env.NODE_ENV !== 'test') {
+        const nodeInfo = await states.node.read();
+        await consumeServerlessNFT({ nftId: blocklet.controller.nftId, nodeInfo, blocklet });
+      }
+
+      if (createNotification) {
+        this._createNotification(did, {
+          title: 'Blocklet Installed',
+          description: `Blocklet ${meta.name}@${meta.version} is installed successfully. (Source: ${
+            deployedFrom || fromBlockletSource(source)
+          })`,
+          action: `/blocklets/${did}/overview`,
+          entityType: 'blocklet',
+          entityId: did,
+          severity: 'success',
         });
-      await forEachBlocklet(blocklet, postInstall, { parallel: true });
-
-      await this.state.setBlockletStatus(did, BlockletStatus.installed);
-      blocklet = await this.ensureBlocklet(did);
-      logger.info('blocklet installed', { source, meta });
-      this.emit(BlockletEvents.installed, { blocklet, context });
+      }
 
-      this.notification.create({
-        title: 'Blocklet Installed',
-        description: `Blocklet ${meta.name}@${meta.version} is installed successfully. (Source: ${
-          deployedFrom || fromBlockletSource(source)
-        })`,
-        action: `/blocklets/${did}/overview`,
-        entityType: 'blocklet',
-        entityId: did,
-        severity: 'success',
-      });
+      await this._rollbackCache.remove({ did: blocklet.meta.did });
       return blocklet;
     } catch (err) {
-      const { meta } = await this.state.getBlocklet(did);
+      const { meta } = await states.blocklet.getBlocklet(did);
       const { name, version } = meta;
       logger.error('failed to install blocklet', { name, did, version, error: err });
       try {
-        await this._rollback('install', did);
-        this.emit(BlockletEvents.installFailed, { meta: { did } });
-        this.notification.create({
+        await this._rollback('install', did, oldBlocklet);
+        this.emit(BlockletEvents.installFailed, {
+          meta: { did },
+          error: {
+            message: err.message,
+          },
+        });
+        this._createNotification(did, {
           title: 'Blocklet Install Failed',
           description: `Blocklet ${meta.name}@${meta.version} install failed with error: ${err.message}`,
           entityType: 'blocklet',
@@ -1905,12 +1937,13 @@ class BlockletManager extends BaseBlockletManager {
     }
   }
 
-  async _upgradeBlocklet({ newBlocklet, oldBlocklet, context }) {
+  async _upgradeBlocklet({ newBlocklet, oldBlocklet, context = {} }) {
     const { meta, source, deployedFrom, children } = newBlocklet;
     const { did, version, name } = meta;
 
-    const oldVersion = oldBlocklet.meta.version;
-    const action = semver.gt(oldBlocklet.meta.version, version) ? 'downgrade' : 'upgrade';
+    // ids
+    context.skippedProcessIds = getSkippedProcessIds({ newBlocklet, oldBlocklet, context });
+
     try {
       // delete old process
       try {
@@ -1921,60 +1954,38 @@ class BlockletManager extends BaseBlockletManager {
       }
 
       // update state
-      await this.state.upgradeBlocklet({ meta, source, deployedFrom, children });
-      await this._setConfigs(did);
+      await states.blocklet.upgradeBlocklet({ meta, source, deployedFrom, children });
+      await this._setConfigsFromMeta(did);
 
+      // should ensure blocklet integrity
       let blocklet = await this.ensureBlocklet(did);
 
       // pre install
-      const nodeEnvironments = await this.node.getEnvironments();
-      const preInstall = (b) =>
-        hooks.preInstall({
-          hooks: Object.assign(b.meta.hooks || {}, b.meta.scripts || {}),
-          env: { ...nodeEnvironments },
-          appDir: blocklet.env.appDir,
-          did, // root blocklet did
-          notification: this.notification,
-          context,
-        });
-      await forEachBlocklet(blocklet, preInstall, { parallel: true });
+      await this._runPreInstallHook(blocklet, context);
 
       // Add environments
-      await this.updateBlockletEnvironment(did);
-      blocklet = await this.ensureBlocklet(did);
+      await this._updateBlockletEnvironment(did);
+      blocklet = await this.getBlocklet(did);
 
       // post install
-      const postInstall = (b) =>
-        hooks.postInstall({
-          hooks: Object.assign(b.meta.hooks || {}, b.meta.scripts || {}),
-          env: getRuntimeEnvironments(b, nodeEnvironments),
-          appDir: b.env.appDir,
-          did, // root blocklet did
-          notification: this.notification,
-          context,
-        });
-      await forEachBlocklet(blocklet, postInstall, { parallel: true });
+      await this._runPostInstallHook(blocklet, context);
 
-      // run migrations
-      const runMigration = (b) => {
-        // BUG: 本身的定义是在执行 upgrade 操作时进行 migration，但是父 blocklet upgrade 时，子 blocklet 可能不需要 upgrade，就会导致子 blocklet 多走了一遍 migration 流程
-        if (b.meta.did === did) {
+      logger.info('start migration');
+      try {
+        const oldVersions = {};
+        forEachBlockletSync(oldBlocklet, (b, { id }) => {
+          oldVersions[id] = b.meta.version;
+        });
+        const nodeEnvironments = await states.node.getEnvironments();
+        const runMigration = (b, { id, ancestors }) => {
           return runMigrationScripts({
             blocklet: b,
-            oldVersion,
-            newVersion: version,
-            env: getRuntimeEnvironments(b, nodeEnvironments),
             appDir: b.env.appDir,
-            did: b.meta.did,
-            notification: this.notification,
-            context,
+            env: getRuntimeEnvironments(b, nodeEnvironments, ancestors),
+            oldVersion: oldVersions[id],
+            newVersion: b.meta.version,
           });
-        }
-        return Promise.resolve();
-      };
-      logger.info('start migration');
-
-      try {
+        };
         await forEachBlocklet(blocklet, runMigration, { parallel: true });
       } catch (error) {
         logger.error('Failed to migrate blocklet', { did, error });
@@ -1984,28 +1995,29 @@ class BlockletManager extends BaseBlockletManager {
 
       logger.info('updated blocklet for upgrading', { did, version, source, name });
 
+      const status =
+        oldBlocklet.status === BlockletStatus.installed ? BlockletStatus.installed : BlockletStatus.stopped;
+      await states.blocklet.setBlockletStatus(did, status, { children: 'all' });
+
       // start new process
       if (oldBlocklet.status === BlockletStatus.running) {
         await this.start({ did }, context);
         logger.info('started blocklet for upgrading', { did, version });
-      } else {
-        const status =
-          oldBlocklet.status === BlockletStatus.installed ? BlockletStatus.installed : BlockletStatus.stopped;
-        await this.state.setBlockletStatus(did, status);
       }
 
-      blocklet = await this.ensureBlocklet(did, context);
+      blocklet = await this.getBlocklet(did, context);
+
+      await fs.writeFile(path.join(blocklet.env.dataDir, 'logo.svg'), createDidLogo(blocklet.meta.did));
+
+      await this._updateDependents(did);
+
       this.refreshListCache();
 
       try {
-        const eventNames = {
-          upgrade: BlockletEvents.upgraded,
-          downgrade: BlockletEvents.downgraded,
-        };
-        this.emit(eventNames[action], { blocklet, context });
-        this.notification.create({
-          title: `Blocklet ${capitalize(action)} Success`,
-          description: `Blocklet ${name}@${version} ${action} successfully. (Source: ${
+        this.emit(BlockletEvents.upgraded, { blocklet, context });
+        this._createNotification(did, {
+          title: 'Blocklet Upgrade Success',
+          description: `Blocklet ${name}@${version} upgrade successfully. (Source: ${
             deployedFrom || fromBlockletSource(source)
           })`,
           action: `/blocklets/${did}/overview`,
@@ -2017,14 +2029,26 @@ class BlockletManager extends BaseBlockletManager {
         logger.error('emit upgrade notification failed', { name, version, error });
       }
 
+      // Update dynamic component meta in blocklet settings
+      await this._ensureDeletedChildrenInSettings(blocklet);
+
+      await this._rollbackCache.remove({ did: blocklet.meta.did });
+
       return blocklet;
     } catch (err) {
-      const b = await this._rollback(action, did, oldBlocklet);
-      logger.error(`failed to ${action} blocklet`, { did, version, name, error: err });
-      this.emit(BlockletEvents.updated, { blocklet: b });
-      this.notification.create({
-        title: `Blocklet ${capitalize(action)} Failed`,
-        description: `Blocklet ${name}@${version} ${action} failed with error: ${err.message}`,
+      const b = await this._rollback('upgrade', did, oldBlocklet);
+      logger.error('failed to upgrade blocklet', { did, version, name, error: err });
+
+      this.emit(BlockletEvents.updated, b);
+
+      this.emit(BlockletEvents.upgradeFailed, {
+        blocklet: { ...oldBlocklet, error: { message: err.message } },
+        context,
+      });
+
+      this._createNotification(did, {
+        title: 'Blocklet Upgrade Failed',
+        description: `Blocklet ${name}@${version} upgrade failed with error: ${err.message}`,
         entityType: 'blocklet',
         entityId: did,
         severity: 'error',
@@ -2033,331 +2057,420 @@ class BlockletManager extends BaseBlockletManager {
     }
   }
 
-  /**
-   * for download: cwd, tarball, did
-   * for verify: verify, integrity
-   * for cancel control: ctrlStore, rootDid
-   */
-  async _downloadTarball({ url, cwd, tarball, did, integrity, verify = true, ctrlStore = {}, rootDid }) {
-    fs.mkdirSync(cwd, { recursive: true });
+  // Refresh deleted component in blocklet settings
+  async _ensureDeletedChildrenInSettings(blocklet) {
+    const { did } = blocklet.meta;
 
-    const tarballName = url.split('/').slice(-1)[0];
+    // TODO 不从 settings 中取值, 直接存在 extra 中
+    let deletedChildren = await states.blockletExtras.getSettings(did, 'children', []);
+    deletedChildren = deletedChildren.filter(
+      (x) => x.status === BlockletStatus.deleted && !blocklet.children.some((y) => y.meta.did === x.meta.did)
+    );
 
-    const tarballPath = path.join(cwd, tarballName);
+    await states.blockletExtras.setSettings(did, { children: deletedChildren });
+  }
 
-    const { protocol, pathname } = new URL(url);
+  /**
+   *
+   *
+   * @param {{}} blocklet
+   * @param {{}} [context={}]
+   * @return {*}
+   * @memberof BlockletManager
+   */
+  async _downloadBlocklet(blocklet, context = {}) {
+    const {
+      meta: { did },
+    } = blocklet;
 
-    const cachedTarFile = await this._getCachedTarFile(integrity);
-    if (cachedTarFile) {
-      logger.info('found cache tarFile', { did, tarballName, integrity });
-      await fs.move(cachedTarFile, tarballPath);
-    } else if (protocol.startsWith('file')) {
-      await fs.copy(decodeURIComponent(pathname), tarballPath);
-    } else {
-      const cancelCtrl = new downloadFile.CancelCtrl();
+    return this.blockletDownloader.download(blocklet, {
+      ...context,
+      preDownload: async ({ downloadComponentIds }) => {
+        // update children status
+        const blocklet1 = await states.blocklet.setBlockletStatus(did, BlockletStatus.downloading, {
+          children: downloadComponentIds,
+        });
+        this.emit(BlockletEvents.statusChange, blocklet1);
+      },
+      postDownload: async ({ isCancelled }) => {
+        if (!isCancelled) {
+          // since preferences only exist in blocklet bundle, we need to populate then after downloaded
+          await this._setConfigsFromMeta(did);
+        }
+      },
+    });
+  }
 
-      if (!ctrlStore[rootDid]) {
-        ctrlStore[rootDid] = new Map();
+  async _syncPm2Status(pm2Status, did) {
+    try {
+      const state = await states.blocklet.getBlocklet(did);
+      if (state && util.shouldUpdateBlockletStatus(state.status)) {
+        const newStatus = pm2StatusMap[pm2Status];
+        await states.blocklet.setBlockletStatus(did, newStatus);
+        logger.info('sync pm2 status to blocklet', { did, pm2Status, newStatus });
       }
-      ctrlStore[rootDid].set(did, cancelCtrl);
+    } catch (error) {
+      logger.error('sync pm2 status to blocklet failed', { did, pm2Status, error });
+    }
+  }
 
-      await downloadFile(url, path.join(cwd, tarballName), { cancelCtrl });
+  /**
+   * @param {string} action install, upgrade, downgrade
+   * @param {string} did
+   * @param {object} oldBlocklet
+   */
+  async _rollback(action, did, oldBlocklet) {
+    if (action === 'install') {
+      const extraState = oldBlocklet?.extraState;
 
-      if (ctrlStore[rootDid]) {
-        ctrlStore[rootDid].delete(did);
-        if (!ctrlStore[rootDid].size) {
-          delete ctrlStore[rootDid];
-        }
+      // rollback blocklet extra state
+      if (extraState) {
+        await states.blockletExtras.update({ did }, extraState);
+      } else {
+        await states.blockletExtras.remove({ did });
       }
 
-      if (cancelCtrl.isCancelled) {
-        return downloadFile.CANCEL;
-      }
+      // remove blocklet state
+      return this._deleteBlocklet({ did, keepData: true });
     }
 
-    if (verify) {
-      try {
-        await verifyIntegrity({ file: tarballPath, integrity });
-      } catch (error) {
-        logger.error('verify integrity error', { error, tarball, url });
-        throw new Error(`${tarball} integrity check failed.`);
-      }
+    if (['upgrade', 'downgrade'].includes(action)) {
+      const { extraState, ...blocklet } = oldBlocklet;
+      // rollback blocklet state
+      const result = await states.blocklet.updateBlocklet(did, blocklet);
+
+      // rollback blocklet extra state
+      await states.blockletExtras.update({ did: blocklet.meta.did }, extraState);
+
+      logger.info('blocklet rollback successfully', { did });
+      this.emit(BlockletEvents.updated, result);
+      return result;
     }
 
-    return tarballPath;
+    logger.error('rollback action is invalid', { action });
+    throw new Error(`rollback action is invalid: ${action}`);
   }
 
-  /**
-   * use LRU algorithm
-   */
-  async _addCacheTarFile(tarballPath, integrity) {
-    // eslint-disable-next-line no-param-reassign
-    integrity = toBase58(integrity);
-
-    // move tarball to cache dir
-    const cwd = path.join(this.dataDirs.tmp, 'download-cache');
-    const cachePath = path.join(cwd, `${integrity}.tar.gz`);
-    await fs.ensureDir(cwd);
-    await fs.move(tarballPath, cachePath, { overwrite: true });
-
-    const key = 'blocklet:manager:downloadCache';
-    const cacheList = (await this.cache.get(key)) || [];
-    const exist = cacheList.find((x) => x.integrity === integrity);
-
-    // update
-    if (exist) {
-      logger.info('update cache tarFile', { base58: integrity });
-      exist.accessAt = Date.now();
-      await this.cache.set(key, cacheList);
-      return;
+  async _deleteBlocklet({ did, keepData, keepLogsDir, keepConfigs }, context) {
+    const blocklet = await states.blocklet.getBlocklet(did);
+    const { name } = blocklet.meta;
+    const cacheDir = path.join(this.dataDirs.cache, name);
+
+    // Cleanup db
+    await this.teamManager.deleteTeam(blocklet.meta.did);
+
+    // Cleanup disk storage
+    fs.removeSync(cacheDir);
+    await this._cleanBlockletData({ blocklet, keepData, keepLogsDir, keepConfigs });
+
+    if (blocklet.mode !== BLOCKLET_MODES.DEVELOPMENT) {
+      const nodeInfo = await states.node.read();
+      const { wallet } = getBlockletInfo(blocklet, nodeInfo.sk);
+      didDocument
+        .disableDNS({ wallet, didRegistryUrl: nodeInfo.didRegistry })
+        .then(() => {
+          logger.info(`disabled blocklet ${blocklet.appDid} dns`);
+        })
+        .catch((err) => {
+          logger.error(`disable blocklet ${blocklet.appDid} dns failed`, { error: err });
+        });
     }
 
-    // add
-    cacheList.push({ integrity, accessAt: Date.now() });
-    if (cacheList.length > 10) {
-      // find and remove
-      let minIndex = 0;
-      let min = cacheList[0];
-      cacheList.forEach((x, i) => {
-        if (x.accessAt < min.accessAt) {
-          minIndex = i;
-          min = x;
-        }
-      });
+    const result = await states.blocklet.deleteBlocklet(did);
+    logger.info('blocklet removed successfully', { did });
 
-      cacheList.splice(minIndex, 1);
-      await fs.remove(path.join(cwd, `${min.integrity}.tar.gz`));
-      logger.info('remove cache tarFile', { base58: min.integrity });
+    let keepRouting = true;
+    if (keepData === false || keepConfigs === false) {
+      keepRouting = false;
     }
-    logger.info('add cache tarFile', { base58: integrity });
 
-    // update
-    await this.cache.set(key, cacheList);
-  }
+    this.runtimeMonitor.delete(blocklet.meta.did);
 
-  async _getCachedTarFile(integrity) {
-    // eslint-disable-next-line no-param-reassign
-    integrity = toBase58(integrity);
+    this.emit(BlockletEvents.removed, {
+      blocklet: result,
+      context: {
+        ...context,
+        keepRouting,
+      },
+    });
+    return blocklet;
+  }
 
-    const cwd = path.join(this.dataDirs.tmp, 'download-cache');
-    const cachePath = path.join(cwd, `${integrity}.tar.gz`);
+  async _cleanBlockletData({ blocklet, keepData, keepLogsDir, keepConfigs }) {
+    const { name } = blocklet.meta;
 
-    if (fs.existsSync(cachePath)) {
-      return cachePath;
-    }
+    const dataDir = path.join(this.dataDirs.data, name);
+    const logsDir = path.join(this.dataDirs.logs, name);
 
-    return null;
-  }
+    logger.info(`clean blocklet ${blocklet.meta.did} data`, { keepData, keepLogsDir, keepConfigs });
 
-  /**
-   * download bundle, verify bundle, resolve bundle to installDir
-   * @param {object} meta
-   * @param {string} rootDid root blocklet did of the blocklet to be downloaded
-   * @return {object} { isCancelled: Boolean }
-   */
-  async _downloadBundle(meta, rootDid, url) {
-    const { name, did, version, dist = {} } = meta;
-    const { tarball, integrity } = dist;
+    if (keepData === false) {
+      fs.removeSync(dataDir);
+      logger.info(`removed blocklet ${blocklet.meta.did} data dir: ${dataDir}`);
 
-    const lockName = `download-${did}-${version}`;
-    let lock = this.downloadLocks[lockName];
-    if (!lock) {
-      lock = new Lock(lockName);
-      this.downloadLocks[lockName] = lock;
-    }
+      fs.removeSync(logsDir);
+      logger.info(`removed blocklet ${blocklet.meta.did} logs dir: ${logsDir}`);
 
-    try {
-      await lock.acquire();
-      logger.info('downloaded blocklet for installing', { name, version, tarball, integrity });
-      const cwd = path.join(this.dataDirs.tmp, 'download', name);
-      await fs.ensureDir(cwd);
-      logger.info('start download blocklet', { name, version, cwd, tarball, integrity });
-      const tarballPath = await this._downloadTarball({
-        name,
-        did,
-        version,
-        cwd,
-        tarball,
-        integrity,
-        verify: true,
-        ctrlStore: this.downloadCtrls,
-        rootDid,
-        url,
-      });
-      logger.info('downloaded blocklet tar file', { name, version, tarballPath });
-      if (tarballPath === downloadFile.CANCEL) {
-        lock.release();
-        return { isCancelled: true };
+      await states.blockletExtras.remove({ did: blocklet.meta.did });
+      logger.info(`removed blocklet ${blocklet.meta.did} extra data`);
+    } else {
+      if (keepLogsDir === false) {
+        fs.removeSync(logsDir);
+        logger.info(`removed blocklet ${blocklet.meta.did} logs dir: ${logsDir}`);
       }
 
-      // resolve tarball and mv tarball to cache after resolved
-      await this._resolveDownload(cwd, tarballPath, null, { removeTarFile: false });
-      await this._addCacheTarFile(tarballPath, integrity);
-
-      logger.info('resolved blocklet tar file to install dir', { name, version });
-      lock.release();
-      return { isCancelled: false };
-    } catch (error) {
-      lock.release();
-      throw error;
+      if (keepConfigs === false) {
+        await states.blockletExtras.remove({ did: blocklet.meta.did });
+        logger.info(`removed blocklet ${blocklet.meta.did} extra data`);
+      }
     }
   }
 
-  async _downloadBlocklet(blocklet, oldBlocklet = {}) {
-    const {
-      meta: { name, did },
-    } = blocklet;
+  async _setConfigsFromMeta(did, childDid) {
+    const blocklet = await getBlocklet({ states, dataDirs: this.dataDirs, did });
 
-    const metas = [];
-    if (
-      ![BlockletSource.upload, BlockletSource.local].includes(blocklet.source) &&
-      get(oldBlocklet, 'meta.dist.integrity') !== get(blocklet, 'meta.dist.integrity')
-    ) {
-      metas.push(blocklet.meta);
-    }
+    if (!childDid) {
+      await forEachBlocklet(blocklet, async (b, { ancestors }) => {
+        const environments = [...get(b.meta, 'environments', []), ...getConfigFromPreferences(b)];
 
-    const oldChildren = (oldBlocklet.children || []).reduce((o, x) => {
-      o[x.meta.did] = x;
-      return o;
-    }, {});
+        // remove default if ancestors has a value
+        ensureEnvDefault(environments, ancestors);
 
-    for (const child of blocklet.children) {
-      const oldChild = oldChildren[child.meta.did];
-      if (!oldChild || oldChild.meta.dist.integrity !== child.meta.dist.integrity) {
-        metas.push(child.meta);
-      }
+        // write configs to db
+        await states.blockletExtras.setConfigs([...ancestors.map((x) => x.meta.did), b.meta.did], environments);
+      });
+    } else {
+      const child = blocklet.children.find((x) => x.meta.did === childDid);
+      await forEachBlocklet(child, async (b, { ancestors }) => {
+        await states.blockletExtras.setConfigs(
+          [blocklet.meta.did, ...ancestors.map((x) => x.meta.did), b.meta.did],
+          [...get(b.meta, 'environments', []), ...getConfigFromPreferences(child)]
+        );
+      });
     }
+  }
 
-    try {
-      const tasks = [];
-      for (const meta of metas) {
-        const url = await this.registry.resolveTarballURL({
+  // to be deleted
+  async _setAppSk(did, appSk, context) {
+    if (process.env.NODE_ENV === 'production' && !appSk) {
+      throw new Error(`appSk for blocklet ${did} is required`);
+    }
+
+    if (appSk) {
+      await this.config(
+        {
           did,
-          tarball: get(meta, 'dist.tarball'),
-          registryUrl: blocklet.source === BlockletSource.registry ? blocklet.deployedFrom : undefined,
-        });
-        tasks.push(this._downloadBundle(meta, did, url));
-      }
-      const results = await Promise.all(tasks);
-      if (results.find((x) => x.isCancelled)) {
-        return { isCancelled: true };
-      }
-    } catch (error) {
-      logger.error('Download blocklet failed', { did, name, error });
-      await this._cancelDownload(blocklet.meta);
-      throw error;
+          configs: [{ key: 'BLOCKLET_APP_SK', value: appSk, secure: true }],
+          skipHook: true,
+          skipDidDocument: true,
+        },
+        context
+      );
     }
+  }
+
+  async _getBlockletForInstallation(did) {
+    const blocklet = await states.blocklet.getBlocklet(did, { decryptSk: false });
+    if (!blocklet) {
+      return null;
+    }
+
+    const extraState = await states.blockletExtras.findOne({ did: blocklet.meta.did });
+    blocklet.extraState = extraState;
 
-    return { isCancelled: false };
+    return blocklet;
   }
 
-  async _syncPm2Status(pm2Status, did) {
+  async _runPreInstallHook(blocklet, context) {
+    const nodeEnvironments = await states.node.getEnvironments();
+
+    const preInstall = (b) =>
+      hooks.preInstall(b.env.processId, {
+        hooks: Object.assign(b.meta.hooks || {}, b.meta.scripts || {}),
+        env: { ...nodeEnvironments },
+        appDir: b.env.appDir,
+        did: blocklet.meta.did, // root blocklet did
+        notification: states.notification,
+        context,
+      });
+
+    await forEachBlocklet(blocklet, preInstall, { parallel: true });
+  }
+
+  async _runPostInstallHook(blocklet, context) {
+    const nodeEnvironments = await states.node.getEnvironments();
+
+    const postInstall = (b, { ancestors }) =>
+      hooks.postInstall(b.env.processId, {
+        hooks: Object.assign(b.meta.hooks || {}, b.meta.scripts || {}),
+        env: getRuntimeEnvironments(b, nodeEnvironments, ancestors),
+        appDir: b.env.appDir,
+        did: blocklet.meta.did, // root blocklet did
+        notification: states.notification,
+        context,
+      });
+
+    await forEachBlocklet(blocklet, postInstall, { parallel: true });
+  }
+
+  async _createNotification(did, notification) {
     try {
-      const state = await this.state.getBlocklet(did);
-      if (state && util.shouldUpdateBlockletStatus(state.status)) {
-        const result = await this.state.setBlockletStatus(did, pm2StatusMap[pm2Status]);
-        logger.info('sync pm2 status to blocklet', { result });
+      const extra = await states.blockletExtras.getMeta(did);
+      const isExternal = !!extra?.controller;
+
+      if (isExternal) {
+        return;
       }
+
+      await states.notification.create(notification);
     } catch (error) {
-      logger.error('sync pm2 status to blocklet failed', { did, pm2Status, error });
+      logger.error('create notification failed', { error });
     }
   }
 
-  // eslint-disable-next-line no-unused-vars
-  async _cancelDownload(blockletMeta, context) {
-    const { did, name, version } = blockletMeta;
+  async _deleteExpiredExternalBlocklet() {
+    try {
+      logger.info('start check expired external blocklet');
+      const blockletExtras = await states.blockletExtras.find(
+        {
+          controller: {
+            $exists: true,
+          },
+          'controller.expiredAt': {
+            $exists: false,
+          },
+        },
+        { did: 1, meta: 1, controller: 1 }
+      );
+
+      for (const data of blockletExtras) {
+        try {
+          const assetState = await util.getNFTState(data.controller.chainHost, data.controller.nftId);
+          const isExpired = isNFTExpired(assetState);
 
-    if (this.downloadCtrls[did]) {
-      for (const cancelCtrl of this.downloadCtrls[did].values()) {
-        cancelCtrl.cancel();
+          if (isExpired) {
+            logger.info('the blocklet already expired', {
+              blockletDid: data.meta.did,
+              nftId: data.controller.nftId,
+            });
+
+            await this.delete({ did: data.meta.did, keepData: true, keepConfigs: true, keepLogsDir: true });
+            logger.info('the expired blocklet already deleted', {
+              blockletDid: data.meta.did,
+              nftId: data.controller.nftId,
+            });
+
+            const expiredAt = getNftExpirationDate(assetState);
+            await states.blockletExtras.updateExpireInfo({ did: data.meta.did, expiredAt });
+            logger.info('updated expired blocklet extra info', {
+              nftId: data.controller.nftId,
+              blockletDid: data.meta.did,
+            });
+
+            // 删除 blocklet 后会 reload nginx, 所以这里每次删除一个
+            if (process.env.NODE_ENV !== 'test') {
+              await sleep(10 * 1000);
+            }
+          }
+        } catch (error) {
+          logger.error('delete expired blocklet failed', {
+            blockletDid: data.meta.did,
+            nftId: data.controller.nftId,
+            error,
+          });
+        }
       }
-      logger.info('cancel download blocklet', { did, name, version });
+
+      logger.info('check expired external blocklet end');
+    } catch (error) {
+      logger.info('check expired external blocklet failed', { error });
     }
   }
 
-  // eslint-disable-next-line no-unused-vars
-  async _cancelWaiting(blockletMeta, context) {
-    const { did, name, version } = blockletMeta;
+  async _cleanExpiredBlockletData() {
+    try {
+      logger.info('start clean expired blocklet data');
+      const blockletExtras = await states.blockletExtras.getExpiredList();
+      if (blockletExtras.length === 0) {
+        logger.info('no expired blocklet data');
+        return;
+      }
 
-    const {
-      job: { postAction, oldBlocklet },
-    } = await this.installQueue.cancel(did);
-    await this._rollback(postAction, did, oldBlocklet);
+      const tasks = blockletExtras.map(async ({ did }) => {
+        const blocklet = await states.blocklet.getBlocklet(did);
+        await this._cleanBlockletData({ blocklet, keepData: false, keepLogsDir: false, keepConfigs: false });
 
-    logger.info('cancel waiting blocklet', { did, name, version });
-  }
+        this.emit(BlockletEvents.dataCleaned, {
+          blocklet,
+          keepRouting: false,
+        });
 
-  /**
-   * @param {string} action install, upgrade, downgrade
-   * @param {string} did
-   * @param {object} oldBlocklet
-   */
-  async _rollback(action, did, oldBlocklet) {
-    if (action === 'install') {
-      // remove blocklet
-      return this._deleteBlocklet({ did, keepData: false });
-    }
+        logger.info(`cleaned expired blocklet blocklet ${did} data`);
+      });
 
-    if (['upgrade', 'downgrade'].includes(action)) {
-      // rollback blocklet
-      const { _id } = await this.state.getBlocklet(did);
-      const result = await this.state.updateById(_id, { $set: oldBlocklet });
-      await this._setConfigs(did);
-      logger.info('blocklet rollback successfully', { did });
-      this.emit(BlockletEvents.updated, { blocklet: result });
-      return result;
-    }
+      await Promise.all(tasks);
 
-    logger.error('rollback action is invalid', { action });
-    throw new Error(`rollback action is invalid: ${action}`);
+      logger.info('clean expired blocklet data done');
+    } catch (error) {
+      logger.error('clean expired blocklet data failed', { error });
+    }
   }
 
-  async _deleteBlocklet({ did, keepData, keepLogsDir, keepConfigs }, context) {
-    const blocklet = await this.state.getBlocklet(did);
-    const { name } = blocklet.meta;
-    const dataDir = path.join(this.dataDirs.data, name);
-    const logsDir = path.join(this.dataDirs.logs, name);
-    const cacheDir = path.join(this.dataDirs.cache, name);
+  async _updateDidDocument(blocklet) {
+    const nodeInfo = await states.node.read();
 
-    // Cleanup disk storage
-    fs.removeSync(cacheDir);
-    if (keepData === false) {
-      fs.removeSync(dataDir);
-      fs.removeSync(logsDir);
-      await this._delExtras(did);
-    } else {
-      if (keepLogsDir === false) {
-        fs.removeSync(logsDir);
-      }
+    const { wallet } = getBlockletInfo(
+      {
+        meta: blocklet.meta,
+        environments: [BLOCKLET_CONFIGURABLE_KEY.BLOCKLET_APP_SK, BLOCKLET_CONFIGURABLE_KEY.BLOCKLET_WALLET_TYPE]
+          .map((key) => ({ key, value: blocklet.configObj[key] }))
+          .filter((x) => x.value),
+      },
+      nodeInfo.sk
+    );
+    const didDomain = getDidDomainForBlocklet({ appPid: blocklet.appPid, didDomain: nodeInfo.didDomain });
 
-      if (keepConfigs === false) {
-        await this._delExtras(did);
-      }
-    }
+    const domainAliases = (get(blocklet, 'site.domainAliases') || []).filter(
+      (item) => !item.value.endsWith(nodeInfo.didDomain) && !item.value.endsWith('did.staging.arcblock.io') // did.staging.arcblock.io 是旧 did domain, 但主要存在于比较旧的节点中, 需要做兼容
+    );
 
-    const result = await this.state.deleteBlocklet(did);
-    logger.info('blocklet removed successfully', { did });
+    domainAliases.push({ value: didDomain, isProtected: true });
 
-    this.emit(BlockletEvents.removed, { blocklet: result, context });
-    return blocklet;
-  }
+    //  先更新 routing rule db 中的 domain aliases, 这一步的目的是为了后面用
+    await states.site.updateDomainAliasList(blocklet.site.id, domainAliases);
 
-  async _setConfigs(did) {
-    const blocklet = await this.state.getBlocklet(did);
-    const { meta } = blocklet;
-    await this.extras.setConfigs(did, get(meta, 'environments', []));
-    for (const child of blocklet.children) {
-      await this.extras.setChildConfigs(did, child.meta.did, get(child.meta, 'environments'));
-    }
+    this.emit(BlockletEvents.appDidChanged, blocklet);
+
+    await didDocument.updateBlockletDocument({
+      wallet,
+      appPid: blocklet.appPid,
+      alsoKnownAs: getBlockletKnownAs(blocklet),
+      daemonDidDomain: util.getServerDidDomain(nodeInfo),
+      didRegistryUrl: nodeInfo.didRegistry,
+      domain: nodeInfo.didDomain,
+    });
+    logger.info('updated blocklet dns document', { appPid: blocklet.appPid, appDid: blocklet.appDid });
   }
 
-  async _delExtras(did) {
-    const blocklet = await this.state.getBlocklet(did);
-    await this.extras.delConfigs(did);
-    await this.extras.delSettings(did);
+  async _updateDependents(did) {
+    const blocklet = await states.blocklet.getBlocklet(did);
+    const map = {};
     for (const child of blocklet.children) {
-      await this.extras.delChildConfigs(did, child.meta.did);
+      child.dependents = [];
+      map[child.meta.did] = child;
     }
+
+    forEachBlockletSync(blocklet, (x, { id }) => {
+      if (x.dependencies) {
+        x.dependencies.forEach((y) => {
+          if (map[y.did]) {
+            map[y.did].dependents.push({ id, required: y.required });
+          }
+        });
+      }
+    });
+
+    await states.blocklet.updateBlocklet(blocklet.meta.did, { children: blocklet.children });
   }
 }