befly 3.9.39 → 3.10.0

package/lib/sqlCheck.ts

@@ -0,0 +1,136 @@
+/**
+ * SQL 入参校验工具（静态类）
+ *
+ * 目标：把“参数合法性/一致性/安全性”判断从 SqlBuilder 等拼接逻辑中拆出来，便于复用与维护。
+ *
+ * 说明：这里的校验仅关注“字符串/标识符/批量数据结构”层面的正确性；
+ * 具体 SQL 语义（如字段是否存在）不在此处校验。
+ */
+
+export class SqlCheck {
+    private static readonly SAFE_IDENTIFIER_RE = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
+
+    static assertNonEmptyString(value: unknown, label: string): asserts value is string {
+        if (typeof value !== "string") {
+            throw new Error(`${label} 必须是字符串 (value: ${String(value)})`);
+        }
+        if (!value.trim()) {
+            throw new Error(`${label} 不能为空`);
+        }
+    }
+
+    static assertNoUndefinedParam(value: unknown, label: string): void {
+        if (value === undefined) {
+            throw new Error(`${label} 不能为 undefined`);
+        }
+    }
+
+    static startsWithQuote(value: string): boolean {
+        const trimmed = value.trim();
+        return trimmed.startsWith("`") || trimmed.startsWith('"');
+    }
+
+    static isQuotedIdentPaired(value: string): boolean {
+        const trimmed = value.trim();
+        if (trimmed.length < 2) return false;
+
+        const first = trimmed[0];
+        const last = trimmed[trimmed.length - 1];
+
+        if (first === "`" && last === "`") return true;
+        if (first === '"' && last === '"') return true;
+
+        return false;
+    }
+
+    static assertPairedQuotedIdentIfStartsWithQuote(value: string, label: string): void {
+        if (SqlCheck.startsWithQuote(value) && !SqlCheck.isQuotedIdentPaired(value)) {
+            throw new Error(`${label} 引用不完整，请使用成对的 \`...\` 或 "..." (value: ${value})`);
+        }
+    }
+
+    static assertSafeIdentifierPart(part: string, kind: "table" | "schema" | "alias" | "field"): void {
+        // 这里仅允许常规标识符（字母/数字/下划线），避免把复杂表达式混进“自动转义”路径。
+        if (!SqlCheck.SAFE_IDENTIFIER_RE.test(part)) {
+            throw new Error(`无效的 ${kind} 标识符: ${part}`);
+        }
+    }
+
+    static assertSafeAlias(aliasPart: string): void {
+        // alias 允许两种：
+        // 1) 已经被引用（`alias` 或 "alias"）
+        // 2) 普通标识符（不允许带空格/符号），避免注入
+        if (SqlCheck.isQuotedIdentPaired(aliasPart)) return;
+        if (!SqlCheck.SAFE_IDENTIFIER_RE.test(aliasPart)) {
+            throw new Error(`无效的字段别名: ${aliasPart}`);
+        }
+    }
+
+    static assertNoExprField(field: string): void {
+        if (typeof field !== "string") return;
+        const trimmed = field.trim();
+        if (!trimmed) return;
+
+        // 收紧：包含函数/表达式（括号）不允许走自动转义路径
+        // 这类表达式应显式使用 selectRaw/whereRaw 以避免误拼接和注入风险
+        if (trimmed.includes("(") || trimmed.includes(")")) {
+            throw new Error(`字段包含函数/表达式，请使用 selectRaw/whereRaw (field: ${trimmed})`);
+        }
+    }
+
+    static assertNoUndefinedInRecord(row: Record<string, unknown>, label: string): void {
+        for (const [key, value] of Object.entries(row)) {
+            if (value === undefined) {
+                throw new Error(`${label} 存在 undefined 字段值 (field: ${key})`);
+            }
+        }
+    }
+
+    static assertBatchInsertRowsConsistent(rows: Array<Record<string, unknown>>, options: { table: string }): string[] {
+        if (!Array.isArray(rows)) {
+            throw new Error("批量插入 rows 必须是数组");
+        }
+        if (rows.length === 0) {
+            throw new Error(`插入数据不能为空 (table: ${options.table})`);
+        }
+
+        const first = rows[0];
+        if (!first || typeof first !== "object" || Array.isArray(first)) {
+            throw new Error(`批量插入的每一行必须是对象 (table: ${options.table}, rowIndex: 0)`);
+        }
+
+        const fields = Object.keys(first);
+        if (fields.length === 0) {
+            throw new Error(`插入数据必须至少有一个字段 (table: ${options.table})`);
+        }
+
+        const fieldSet = new Set(fields);
+
+        for (let i = 0; i < rows.length; i++) {
+            const row = rows[i];
+            if (!row || typeof row !== "object" || Array.isArray(row)) {
+                throw new Error(`批量插入的每一行必须是对象 (table: ${options.table}, rowIndex: ${i})`);
+            }
+
+            const rowKeys = Object.keys(row);
+            if (rowKeys.length !== fields.length) {
+                throw new Error(`批量插入每行字段必须一致 (table: ${options.table}, rowIndex: ${i})`);
+            }
+
+            for (const key of rowKeys) {
+                if (!fieldSet.has(key)) {
+                    throw new Error(`批量插入每行字段必须一致 (table: ${options.table}, rowIndex: ${i}, extraField: ${key})`);
+                }
+            }
+
+            for (const field of fields) {
+                if (!(field in row)) {
+                    throw new Error(`批量插入缺少字段 (table: ${options.table}, rowIndex: ${i}, field: ${field})`);
+                }
+                SqlCheck.assertNoUndefinedParam((row as any)[field], `批量插入字段值 (table: ${options.table}, rowIndex: ${i}, field: ${field})`);
+            }
+        }
+
+        return fields;
+    }
+}

package/lib/validator.ts

@@ -5,7 +5,7 @@
 
 import type { TableDefinition, FieldDefinition, ValidateResult, SingleResult } from "../types/validate.js";
 
-import { RegexAliases, getCompiledRegex } from "../utils/regex.js";
+import { RegexAliases, getCompiledRegex } from "../configs/presetRegexp.js";
 
 /**
  * 验证器类

package/loader/loadApis.ts

@@ -5,142 +5,39 @@
 
 // 类型导入
 import type { ApiRoute } from "../types/api.js";
+import type { ScanFileResult } from "../utils/scanFiles.js";
 
 import { Logger } from "../lib/logger.js";
-import { projectApiDir } from "../paths.js";
-import { scanAddons, getAddonDir, addonDirExists } from "../utils/addonHelper.js";
-import { makeRouteKey } from "../utils/route.js";
-// 相对导入
-import { scanFiles } from "../utils/scanFiles.js";
-
-/**
- * 预定义的默认字段
- */
-const PRESET_FIELDS: Record<string, any> = {
-    "@id": { name: "ID", type: "number", min: 1, max: null },
-    "@page": { name: "页码", type: "number", min: 1, max: 9999, default: 1 },
-    "@limit": { name: "每页数量", type: "number", min: 1, max: 100, default: 30 },
-    "@keyword": { name: "关键词", type: "string", min: 0, max: 50 },
-    "@state": { name: "状态", type: "number", regex: "^[0-2]$" }
-};
-
-/**
- * 处理字段定义：将 @ 符号引用替换为实际字段定义
- */
-function processFields(fields: Record<string, any>, apiName: string, routePath: string): Record<string, any> {
-    if (!fields || typeof fields !== "object") return fields;
-
-    const processed: Record<string, any> = {};
-    for (const [key, value] of Object.entries(fields)) {
-        if (typeof value === "string" && value.startsWith("@")) {
-            if (PRESET_FIELDS[value]) {
-                processed[key] = PRESET_FIELDS[value];
-                continue;
-            }
-
-            const validKeys = Object.keys(PRESET_FIELDS).join(", ");
-            throw new Error(`API [${apiName}] (${routePath}) 字段 [${key}] 引用了未定义的预设字段 "${value}"。可用的预设字段有: ${validKeys}`);
-        }
-
-        processed[key] = value;
-    }
-
-    return processed;
-}
+import { processFields } from "../utils/processFields.js";
 
 /**
  * 加载所有 API 路由
- * @param apis - API 跁由映射表
+ * @param apiItems - scanSources/scanFiles 扫描到的 API 条目数组
+ * @returns API 路由映射表
  */
-export async function loadApis(apis: Map<string, ApiRoute>): Promise<void> {
-    try {
-        // 1. 扫描项目 API
-        const projectApiFiles = await scanFiles(projectApiDir);
-        const projectApiList = projectApiFiles.map((file) => ({
-            filePath: file.filePath,
-            relativePath: file.relativePath,
-            type: "project" as const,
-            routePrefix: "/",
-            typeName: "项目"
-        }));
-
-        // 2. 扫描组件 API
-        const addonApiList: Array<{
-            filePath: string;
-            relativePath: string;
-            type: "addon";
-            routePrefix: string;
-            typeName: string;
-        }> = [];
-        const addons = scanAddons();
-        for (const addon of addons) {
-            if (!addonDirExists(addon, "apis")) continue;
-
-            const addonApiDir = getAddonDir(addon, "apis");
-            const addonApiFiles = await scanFiles(addonApiDir);
-
-            for (const file of addonApiFiles) {
-                addonApiList.push({
-                    filePath: file.filePath,
-                    relativePath: file.relativePath,
-                    type: "addon" as const,
-                    routePrefix: `/addon/${addon}/`, // 组件 API 默认带斜杠
-                    typeName: `组件${addon}`
-                });
-            }
+export async function loadApis(apis: ScanFileResult[]): Promise<Map<string, ApiRoute>> {
+    const apisMap = new Map<string, ApiRoute>();
+
+    for (const api of apis) {
+        const apiType = (api as any).type;
+        // 兼容：scanFiles 的结果或测试构造数据可能缺少 type 字段；缺少时默认按 API 处理。
+        // 仅在 type 显式存在且不等于 "api" 时跳过，避免错误过滤。
+        if (apiType && apiType !== "api") {
+            continue;
         }
 
-        // 3. 合并所有 API 文件
-        const allApiFiles = [...projectApiList, ...addonApiList];
+        try {
+            const apiRoute = api as any;
 
-        // 4. 遍历处理所有 API 文件
-        for (const apiFile of allApiFiles) {
-            try {
-                // Windows 下路径需要转换为正斜杠格式
-                const normalizedFilePath = apiFile.filePath.replace(/\\/g, "/");
-                const apiImport = await import(normalizedFilePath);
-                const api = apiImport.default;
+            // 处理字段定义，将 @ 引用替换为实际字段定义
+            apiRoute.fields = processFields(apiRoute.fields || {}, apiRoute.name, apiRoute.routePath);
 
-                api.name = api.name || apiFile.relativePath;
-
-                // 设置默认值
-                const methodStr = (api.method || "POST").toUpperCase();
-                api.auth = api.auth !== undefined ? api.auth : true;
-
-                // 构建路由路径（用于错误提示）
-                const routePath = `/api${apiFile.routePrefix}${apiFile.relativePath}`;
-
-                // 处理字段定义，将 @ 引用替换为实际字段定义
-                api.fields = processFields(api.fields || {}, api.name, routePath);
-                api.required = api.required || [];
-
-                // 支持逗号分隔的多方法，拆分后分别注册
-                const methods = methodStr
-                    .split(",")
-                    .map((m: string) => m.trim())
-                    .filter((m: string) => m);
-                for (const method of methods) {
-                    const route = makeRouteKey(method, routePath);
-                    // 为每个方法创建独立的路由对象
-                    const routeApi: ApiRoute = {
-                        name: api.name,
-                        handler: api.handler,
-                        method: method,
-                        auth: api.auth,
-                        fields: api.fields,
-                        required: api.required,
-                        rawBody: api.rawBody,
-                        route: route
-                    };
-                    apis.set(route, routeApi);
-                }
-            } catch (error: any) {
-                Logger.error({ err: error, api: apiFile.relativePath, type: apiFile.typeName }, "接口加载失败");
-                process.exit(1);
-            }
+            apisMap.set(apiRoute.routePath, apiRoute as ApiRoute);
+        } catch (error: any) {
+            Logger.error({ err: error, api: api.relativePath, file: api.filePath }, "接口加载失败");
+            throw error;
         }
-    } catch (error: any) {
-        Logger.error({ err: error }, "加载 API 时发生错误");
-        process.exit(1);
     }
+
+    return apisMap;
 }

package/loader/loadHooks.ts

@@ -1,66 +1,51 @@
 /**
  * 钩子加载器
- * 默认只加载核心钩子
- * 可选：通过配置开启组件/项目钩子（默认关闭以保持稳定性与可预期性）
+ * 默认加载所有来源钩子（core/addon/app）
+ * 可通过 disableHooks 禁用指定钩子
  */
 
 // 类型导入
 import type { Hook } from "../types/hook.js";
+import type { ScanFileResult } from "../utils/scanFiles.js";
 
-import { beflyConfig } from "../befly.config.js";
 import { Logger } from "../lib/logger.js";
-import { coreHookDir, projectHookDir } from "../paths.js";
-// 相对导入
-import { scanAddons, getAddonDir, addonDirExists } from "../utils/addonHelper.js";
-import { scanModules } from "../utils/modules.js";
+import { sortModules } from "../utils/sortModules.js";
 
-export async function loadHooks(hooks: Hook[]): Promise<void> {
-    try {
-        const allHooks: Hook[] = [];
+export async function loadHooks(hooks: ScanFileResult[], disableHooks: string[] = []): Promise<Hook[]> {
+    const hooksMap: Hook[] = [];
 
-        // 1. 扫描核心钩子
-        const coreHooks = await scanModules<Hook>(coreHookDir, "core", "钩子");
-        allHooks.push(...coreHooks);
+    if (disableHooks.length > 0) {
+        Logger.info({ hooks: disableHooks }, "禁用钩子");
+    }
 
-        // 2. 可选：扫描组件钩子（默认关闭）
-        const enableAddonHooks = Boolean((beflyConfig as any).enableAddonHooks);
-        if (enableAddonHooks) {
-            const addonHooks: Hook[] = [];
-            const addons = scanAddons();
-            for (const addon of addons) {
-                if (!addonDirExists(addon, "hooks")) continue;
-                const dir = getAddonDir(addon, "hooks");
-                const items = await scanModules<Hook>(dir, "addon", "钩子", addon);
-                addonHooks.push(...items);
-            }
-            allHooks.push(...addonHooks);
+    const enabledHooks = hooks.filter((item: any) => {
+        const moduleName = item?.moduleName;
+        if (typeof moduleName !== "string" || moduleName.trim() === "") {
+            return false;
         }
 
-        // 3. 可选：扫描项目钩子（默认关闭）
-        const enableAppHooks = Boolean((beflyConfig as any).enableAppHooks);
-        if (enableAppHooks) {
-            const appHooks = await scanModules<Hook>(projectHookDir, "app", "钩子");
-            allHooks.push(...appHooks);
+        if (disableHooks.includes(moduleName)) {
+            return false;
         }
 
-        // 4. 过滤禁用的钩子
-        const disableHooks = beflyConfig.disableHooks || [];
-        const enabledHooks = allHooks.filter((hook) => hook.name && !disableHooks.includes(hook.name));
+        return true;
+    });
 
-        if (disableHooks.length > 0) {
-            Logger.info({ hooks: disableHooks }, "禁用钩子");
-        }
+    const sortedHooks = sortModules(enabledHooks, { moduleLabel: "钩子" });
+    if (sortedHooks === false) {
+        throw new Error("钩子依赖关系错误");
+    }
 
-        // 5. 按 order 排序
-        const sortedHooks = enabledHooks.sort((a, b) => {
-            const orderA = a.order ?? 999;
-            const orderB = b.order ?? 999;
-            return orderA - orderB;
-        });
+    for (const item of sortedHooks) {
+        const hookName = (item as any).moduleName as string;
+        const hook = item as any as Hook;
 
-        hooks.push(...sortedHooks);
-    } catch (error: any) {
-        Logger.error({ err: error }, "加载钩子时发生错误");
-        process.exit(1);
+        hooksMap.push({
+            name: hookName,
+            deps: hook.deps,
+            handler: hook.handler
+        });
     }
+
+    return hooksMap;
 }

package/loader/loadPlugins.ts

@@ -5,67 +5,52 @@
 
 import type { BeflyContext } from "../types/befly.js";
 import type { Plugin } from "../types/plugin.js";
+import type { ScanFileResult } from "../utils/scanFiles.js";
 
-import { beflyConfig } from "../befly.config.js";
 import { Logger } from "../lib/logger.js";
-import { corePluginDir, projectPluginDir } from "../paths.js";
-import { scanAddons, getAddonDir } from "../utils/addonHelper.js";
-import { sortModules, scanModules } from "../utils/modules.js";
+import { sortModules } from "../utils/sortModules.js";
 
-export async function loadPlugins(plugins: Plugin[], context: BeflyContext): Promise<void> {
-    try {
-        const allPlugins: Plugin[] = [];
+export async function loadPlugins(plugins: ScanFileResult[], context: BeflyContext, disablePlugins: string[] = []): Promise<Plugin[]> {
+    const pluginsMap: Plugin[] = [];
 
-        // 1. 扫描核心插件
-        const corePlugins = await scanModules<Plugin>(corePluginDir, "core", "插件");
-
-        // 2. 扫描组件插件
-        const addonPlugins: Plugin[] = [];
-        const addons = scanAddons();
-        for (const addon of addons) {
-            const dir = getAddonDir(addon, "plugins");
-            const plugins = await scanModules<Plugin>(dir, "addon", "插件", addon);
-            addonPlugins.push(...plugins);
-        }
-
-        // 3. 扫描项目插件
-        const appPlugins = await scanModules<Plugin>(projectPluginDir, "app", "插件");
-
-        // 4. 合并所有插件
-        allPlugins.push(...corePlugins);
-        allPlugins.push(...addonPlugins);
-        allPlugins.push(...appPlugins);
-
-        // 5. 过滤禁用的插件
-        const disablePlugins = beflyConfig.disablePlugins || [];
-        const enabledPlugins = allPlugins.filter((plugin) => plugin.name && !disablePlugins.includes(plugin.name));
+    if (disablePlugins.length > 0) {
+        Logger.info({ plugins: disablePlugins }, "禁用插件");
+    }
 
-        if (disablePlugins.length > 0) {
-            Logger.info({ plugins: disablePlugins }, "禁用插件");
+    const enabledPlugins = plugins.filter((item: any) => {
+        const moduleName = item?.moduleName;
+        if (typeof moduleName !== "string" || moduleName.trim() === "") {
+            return false;
         }
-
-        // 6. 排序与初始化
-        const sortedPlugins = sortModules(enabledPlugins);
-        if (sortedPlugins === false) {
-            Logger.error("插件依赖关系错误，请检查 after 属性");
-            process.exit(1);
+        if (disablePlugins.includes(moduleName)) {
+            return false;
         }
+        return true;
+    });
 
-        for (const plugin of sortedPlugins) {
-            try {
-                plugins.push(plugin);
-
-                const pluginInstance = typeof plugin.handler === "function" ? await plugin.handler(context) : {};
+    const sortedPlugins = sortModules(enabledPlugins, { moduleLabel: "插件" });
+    if (sortedPlugins === false) {
+        throw new Error("插件依赖关系错误");
+    }
 
-                // 直接挂载到 befly 下
-                (context as any)[plugin.name!] = pluginInstance;
-            } catch (error: any) {
-                Logger.error({ err: error, plugin: plugin.name }, "插件初始化失败");
-                process.exit(1);
-            }
+    for (const item of sortedPlugins) {
+        const pluginName = (item as any).moduleName as string;
+        const plugin = item as any as Plugin;
+
+        try {
+            const pluginInstance = typeof plugin.handler === "function" ? await plugin.handler(context) : {};
+            (context as any)[pluginName] = pluginInstance;
+
+            pluginsMap.push({
+                name: pluginName,
+                deps: plugin.deps,
+                handler: plugin.handler
+            });
+        } catch (error: any) {
+            Logger.error({ err: error, plugin: pluginName }, "插件初始化失败");
+            throw error;
         }
-    } catch (error: any) {
-        Logger.error({ err: error }, "加载插件时发生错误");
-        process.exit(1);
     }
+
+    return pluginsMap;
 }

package/main.ts

@@ -9,11 +9,12 @@ import type { BeflyContext, BeflyOptions } from "./types/befly.js";
 import type { Hook } from "./types/hook.js";
 import type { Plugin } from "./types/plugin.js";
 
-// ========== 相对导入（项目内部文件） ==========
-// 启动检查
 import { checkApi } from "./checks/checkApi.js";
-import { checkApp } from "./checks/checkApp.js";
+import { checkHook } from "./checks/checkHook.js";
+import { checkMenu } from "./checks/checkMenu.js";
+import { checkPlugin } from "./checks/checkPlugin.js";
 import { checkTable } from "./checks/checkTable.js";
+// ========== 相对导入（项目内部文件） ==========
 // 基础设施
 import { Connect } from "./lib/connect.js";
 import { Logger } from "./lib/logger.js";
@@ -25,10 +26,15 @@ import { loadPlugins } from "./loader/loadPlugins.js";
 import { apiHandler } from "./router/api.js";
 import { staticHandler } from "./router/static.js";
 // 同步
-import { syncAllCommand } from "./sync/syncAll.js";
+import { syncApi } from "./sync/syncApi.js";
+import { syncCache } from "./sync/syncCache.js";
+import { syncDev } from "./sync/syncDev.js";
+import { syncMenu } from "./sync/syncMenu.js";
+import { syncTable } from "./sync/syncTable.js";
 // 工具
 import { calcPerfTime } from "./utils/calcPerfTime.js";
-import { isPrimaryProcess, getProcessRole } from "./utils/process.js";
+import { getProcessRole } from "./utils/process.js";
+import { scanSources } from "./utils/scanSources.js";
 
 /**
  * Befly 框架核心类
@@ -62,28 +68,61 @@ export class Befly {
             const { beflyConfig } = await import("./befly.config.js");
             this.config = beflyConfig;
 
-            // 1. 执行启动检查
-            await checkApp();
-            await checkTable();
-            await checkApi();
+            // 将配置注入到 ctx，供插件/Hook/sync 等按需读取
+            this.context.config = this.config;
+
+            const { apis, tables, plugins, hooks, addons } = await scanSources();
+
+            // 让后续 syncMenu 能拿到 addon 的 views 路径等信息
+            this.context.addons = addons;
+
+            await checkApi(apis);
+            await checkTable(tables);
+            await checkPlugin(plugins);
+            await checkHook(hooks);
+            const checkedMenus = await checkMenu(addons, { disableMenus: this.config.disableMenus || [] });
+
+            // 1. 启动期建立基础连接（SQL + Redis）
+            // 说明：连接职责收敛到启动期单点；插件只消费已连接实例（Connect.getSql/getRedis）。
+            await Connect.connect({
+                db: this.config.db || {},
+                redis: this.config.redis || {}
+            });
 
             // 2. 加载插件
-            await loadPlugins(this.plugins, this.context as BeflyContext);
+            this.plugins = await loadPlugins(plugins as any, this.context as BeflyContext, this.config!.disablePlugins || []);
+
+            // 启动期依赖完整性检查：避免 sync 阶段出现 undefined 调用
+            // 注意：这里不做兼容别名（例如 dbHelper=db），要求上下文必须注入标准字段。
+            if (!(this.context as any).redis) {
+                throw new Error("启动失败：ctx.redis 未初始化（Redis 插件未加载或注入失败）");
+            }
+            if (!(this.context as any).db) {
+                throw new Error("启动失败：ctx.db 未初始化（Db 插件未加载或注入失败）");
+            }
+            if (!(this.context as any).cache) {
+                throw new Error("启动失败：ctx.cache 未初始化（cache 插件未加载或注入失败）");
+            }
+
+            // 5. 自动同步 (仅主进程执行，避免集群模式下重复执行)
+            await syncTable(this.context as BeflyContext, tables);
+            await syncApi(this.context as BeflyContext, apis as any);
+
+            await syncMenu(this.context as BeflyContext, checkedMenus);
+            await syncDev(this.context as BeflyContext, { devEmail: this.config.devEmail, devPassword: this.config.devPassword });
+
+            // 缓存同步：统一在所有同步完成后执行（cacheApis + cacheMenus + rebuildRoleApiPermissions）
+            await syncCache(this.context as BeflyContext);
 
             // 3. 加载钩子
-            await loadHooks(this.hooks);
+            this.hooks = await loadHooks(hooks as any, this.config!.disableHooks || []);
 
             // 4. 加载所有 API
-            await loadApis(this.apis);
-
-            // 5. 自动同步 (仅主进程执行，避免集群模式下重复执行)
-            if (isPrimaryProcess()) {
-                await syncAllCommand();
-            }
+            this.apis = await loadApis(apis as any);
 
-            // 6. 启动 HTTP 服务器
+            // 6. 启动 HTTP服务器
             const apiFetch = apiHandler(this.apis, this.hooks, this.context as BeflyContext);
-            const staticFetch = staticHandler();
+            const staticFetch = staticHandler(this.config!.cors);
 
             const server = Bun.serve({
                 port: this.config!.appPort,