diff --git a/bun.lockb b/bun.lockb
index 29ba696..46934e6 100755
Binary files a/bun.lockb and b/bun.lockb differ
diff --git a/dockerzip b/dockerzip
index 752b28f..43af9e0 100644
Binary files a/dockerzip and b/dockerzip differ
diff --git a/pkgs/api/_file.ts b/pkgs/api/_file.ts
index e981611..c746e2f 100644
--- a/pkgs/api/_file.ts
+++ b/pkgs/api/_file.ts
@@ -16,15 +16,15 @@ export const _ = {
   async api() {
     const { req } = apiContext(this);
     let rpath = decodeURIComponent(req.params._);
-
-    let res = new Response("NOT FOUND", { status: 404 });
-
     rpath = rpath
       .split("/")
       .map((e) => e.replace(/\.\./gi, ""))
       .filter((e) => !!e)
       .join("/");
 
+    let res = new Response("NOT FOUND", { status: 404 });
+
+
     if (Object.keys(req.query_parameters).length > 0) {
       await dirAsync(dir(`${g.datadir}/files`));
       const base_dir = dir(`${g.datadir}/files/${rpath}`);
diff --git a/pkgs/api/_img.ts b/pkgs/api/_img.ts
new file mode 100644
index 0000000..8dbe13e
--- /dev/null
+++ b/pkgs/api/_img.ts
@@ -0,0 +1,55 @@
+import { dirAsync } from "fs-jetpack";
+import { apiContext } from "service-srv";
+import { dir } from "utils/dir";
+import { g } from "utils/global";
+import { dirname, parse } from "path";
+import sharp from "sharp";
+
+export const _ = {
+  url: "/_img/**",
+  async api() {
+    const { req } = apiContext(this);
+    let res = new Response("NOT FOUND", { status: 404 });
+
+    const w = parseInt(req.query_parameters.w);
+    let force = typeof req.query_parameters.force === "string";
+
+    let rpath = decodeURIComponent(req.params._);
+    rpath = rpath
+      .split("/")
+      .map((e) => e.replace(/\.\./gi, ""))
+      .filter((e) => !!e)
+      .join("/");
+
+    if (!w) {
+      const file = Bun.file(dir(`${g.datadir}/files/${rpath}`));
+      return new Response(file);
+    } else {
+      const original = Bun.file(dir(`${g.datadir}/files/${rpath}`));
+      if (await original.exists()) {
+        const p = parse(dir(`${g.datadir}/files/${rpath}`));
+        if (p.ext === ".svg") {
+          return new Response(original);
+        }
+
+        const file_name = dir(`${g.datadir}/files/thumb/${w}/${rpath}`);
+        let file = Bun.file(file_name);
+        if (!(await file.exists())) {
+          await dirAsync(dirname(file_name));
+          force = true;
+        }
+
+        if (force) {
+          const img = sharp(await original.arrayBuffer());
+          const out = await img.resize({ width: w, fit: "inside" }).toBuffer();
+          await Bun.write(file_name, out);
+          file = Bun.file(file_name);
+        }
+
+        return new Response(file);
+      }
+    }
+
+    return res;
+  },
+};
diff --git a/pkgs/api/_proxy.ts b/pkgs/api/_proxy.ts
index 5b7a908..4f2d7f5 100644
--- a/pkgs/api/_proxy.ts
+++ b/pkgs/api/_proxy.ts
@@ -1,41 +1,40 @@
-import { g } from "utils/global";
-import { gzipAsync } from "utils/gzip";
+import { apiContext } from "service-srv";
 
 export const _ = {
   url: "/_proxy/*",
-  async api(arg: {
-    url: string;
-    method: "POST" | "GET";
-    headers: any;
-    body: any;
-  }) {
-    const res = await fetch(
-      arg.url,
-      arg.body
-        ? {
-            method: arg.method || "POST",
-            headers: arg.headers,
-            body: arg.body,
-          }
-        : {
-            headers: arg.headers,
-          }
-    );
+  raw: true,
+  async api() {
+    const { req } = apiContext(this);
 
-    let body: any = null;
-    const headers: any = {};
-    res.headers.forEach((v, k) => {
-      headers[k] = v;
-    });
+    try {
+      const url = new URL(decodeURIComponent(req.params["_"]));
+      const body = await req.arrayBuffer();
+      const headers = {} as Record<string, string>;
+      req.headers.forEach((v, k) => {
+        if (k.startsWith("sec-")) return;
+        if (k.startsWith("connection")) return;
+        if (k.startsWith("dnt")) return;
+        if (k.startsWith("host")) return;
+        headers[k] = v;
+      });
 
-    body = await res.arrayBuffer();
-
-    if (headers["content-encoding"] === "gzip") {
-      body = await gzipAsync(new Uint8Array(body));
-    } else {
-      delete headers["content-encoding"];
+      return await fetch(url, {
+        method: req.method || "POST",
+        headers,
+        body,
+      });
+    } catch (e: any) {
+      console.error(e);
+      new Response(
+        JSON.stringify({
+          status: "failed",
+          reason: e.message,
+        }),
+        {
+          status: 403,
+          headers: { "content-type": "application/json" },
+        }
+      );
     }
-
-    return new Response(body, { headers });
   },
 };
diff --git a/pkgs/package.json b/pkgs/package.json
index cdd0b07..e0fcdb1 100644
--- a/pkgs/package.json
+++ b/pkgs/package.json
@@ -16,6 +16,6 @@
     "typescript": "^5.2.2",
     "unzipper": "^0.10.14",
     "parse-multipart-data": "^1.5.0",
-    "fast-myers-diff": "^3.2.0"
+    "sharp": "^0.33.2"
   }
 }
\ No newline at end of file
diff --git a/pkgs/utils/query.ts b/pkgs/utils/query.ts
index dc907e6..3fe72c7 100644
--- a/pkgs/utils/query.ts
+++ b/pkgs/utils/query.ts
@@ -1,3 +1,4 @@
+import { Prisma } from "../../app/db/db";
 
 export type DBArg = {
   db: string;
@@ -15,9 +16,7 @@ export const execQuery = async (args: DBArg, prisma: any) => {
     if (action === "query" && table.startsWith("$query")) {
       try {
         const q = params.shift();
-        q.sql = true;
-        Object.freeze(q);
-        return await tableInstance.bind(prisma)(q, ...params);
+        return await tableInstance.bind(prisma)(Prisma.sql(q, ...params));
       } catch (e) {
         console.log(e);
         return e;