refactor(backend): rename OpenFlare directory to lowercase openflare

backend/openflare/plugins/server/domain/site/config_version/certificate_snapshot_test.go

@@ -0,0 +1,119 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package config_version
+
+import (
+	"context"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/pem"
+	"math/big"
+	"strings"
+	"testing"
+	"time"
+
+	"Wavelet/openflare/plugins/server/kernel/repository"
+
+	oftls "Wavelet/openflare/plugins/server/domain/tls"
+	"Wavelet/openflare/plugins/server/kernel/model"
+	"Wavelet/openflare/plugins/server/kernel/runtimeconfig"
+	db "Wavelet/plugins/infra/database"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestBuildCertificateSupportFilesDecryptsSealedPrivateKey(t *testing.T) {
+	cleanup := setupConfigVersionTestDB(t)
+	defer cleanup()
+	require.NoError(t, db.DB(context.Background()).AutoMigrate(&model.TLSCertificate{}))
+
+	previous := runtimeconfig.Get()
+	runtimeconfig.SetSessionSecret("test-session-secret-for-tls-seal")
+	t.Cleanup(func() { runtimeconfig.Set(previous) })
+
+	ctx := context.Background()
+	certPEM, keyPEM := generateTestCertKeyPairForSnapshot(t)
+	certificate, err := oftls.CreateCertificate(ctx, oftls.CertificateInput{
+		Name:    "publish-cert",
+		CertPEM: certPEM,
+		KeyPEM:  keyPEM,
+	})
+	require.NoError(t, err)
+
+	files, err := buildCertificateSupportFiles(ctx, []snapshotRoute{
+		{DomainCertIDs: []uint{certificate.ID}},
+	})
+	require.NoError(t, err)
+	require.Len(t, files, 2)
+
+	var keyContent string
+	for _, file := range files {
+		if file.Path == certificateKeyFileName(certificate.ID) {
+			keyContent = file.Content
+		}
+		assert.NotContains(t, file.Content, "enc:v1:")
+	}
+	assert.Contains(t, keyContent, "BEGIN")
+	assert.Equal(t, normalizePEM(strings.TrimSpace(keyPEM)), keyContent)
+}
+
+func TestBuildSnapshotReadsZoneDomainCertificates(t *testing.T) {
+	cleanup := setupConfigVersionTestDB(t)
+	defer cleanup()
+	ctx := context.Background()
+	require.NoError(t, db.DB(ctx).AutoMigrate(&model.TLSCertificate{}))
+
+	previous := runtimeconfig.Get()
+	runtimeconfig.SetSessionSecret("test-session-secret-for-zone-domain-snapshots")
+	t.Cleanup(func() { runtimeconfig.Set(previous) })
+
+	firstCertPEM, firstKeyPEM := generateTestCertKeyPairForSnapshotForDomain(t, "one.example.com")
+	first, err := oftls.CreateCertificate(ctx, oftls.CertificateInput{Name: "first", CertPEM: firstCertPEM, KeyPEM: firstKeyPEM})
+	require.NoError(t, err)
+	secondCertPEM, secondKeyPEM := generateTestCertKeyPairForSnapshotForDomain(t, "two.example.com")
+	second, err := oftls.CreateCertificate(ctx, oftls.CertificateInput{Name: "second", CertPEM: secondCertPEM, KeyPEM: secondKeyPEM})
+	require.NoError(t, err)
+
+	route := &model.ProxyRoute{SiteName: "tls-site", OriginURL: "http://origin:8080", Upstreams: `["http://origin:8080"]`, Enabled: true, EnableHTTPS: true}
+	require.NoError(t, repository.CreateProxyRouteRecord(ctx, route))
+	zone := &model.Zone{Domain: "example.com"}
+	require.NoError(t, db.DB(ctx).Create(zone).Error)
+	require.NoError(t, db.DB(ctx).Create(&model.ZoneDomain{ZoneID: zone.ID, ProxyRouteID: &route.ID, Domain: "one.example.com", CertID: &first.ID}).Error)
+	require.NoError(t, db.DB(ctx).Create(&model.ZoneDomain{ZoneID: zone.ID, ProxyRouteID: &route.ID, Domain: "two.example.com", CertID: &second.ID}).Error)
+
+	bundle, err := buildCurrentConfigBundle(ctx, true)
+	require.NoError(t, err)
+	require.Len(t, bundle.SnapshotRoutes, 1)
+	assert.Equal(t, []string{"one.example.com", "two.example.com"}, bundle.SnapshotRoutes[0].Domains)
+	assert.Equal(t, []uint{first.ID, second.ID}, bundle.SnapshotRoutes[0].DomainCertIDs)
+	assert.Contains(t, bundle.RouteConfig, "server_name one.example.com;")
+	assert.Contains(t, bundle.RouteConfig, "server_name two.example.com;")
+}
+
+func generateTestCertKeyPairForSnapshot(t *testing.T) (certPEM string, keyPEM string) {
+	t.Helper()
+	return generateTestCertKeyPairForSnapshotForDomain(t, "test.example.com")
+}
+
+func generateTestCertKeyPairForSnapshotForDomain(t *testing.T, domain string) (certPEM string, keyPEM string) {
+	t.Helper()
+	privateKey, err := rsa.GenerateKey(rand.Reader, 2048)
+	require.NoError(t, err)
+	template := x509.Certificate{
+		SerialNumber: big.NewInt(1),
+		Subject:      pkix.Name{CommonName: domain},
+		DNSNames:     []string{domain},
+		NotBefore:    time.Now().Add(-time.Hour),
+		NotAfter:     time.Now().Add(24 * time.Hour),
+		KeyUsage:     x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
+	}
+	der, err := x509.CreateCertificate(rand.Reader, &template, &template, &privateKey.PublicKey, privateKey)
+	require.NoError(t, err)
+	certPEM = string(pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der}))
+	keyPEM = string(pem.EncodeToMemory(&pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(privateKey)}))
+	return certPEM, keyPEM
+}

backend/openflare/plugins/server/domain/site/config_version/errs.go

@@ -0,0 +1,13 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+// Package config_version defines shared error messages for configuration versions.
+package config_version
+
+const (
+	errNoActiveVersion       = "当前没有激活版本"
+	errNoEnabledRoutes       = "没有可发布的启用规则"
+	errNoChangesToPublish    = "当前规则没有变更，不能重复发布"
+	errVersionConflict       = "版本号生成冲突，请重试"
+	errInvalidSnapshotFormat = "历史版本快照格式不合法"
+)

backend/openflare/plugins/server/domain/site/config_version/helpers.go

@@ -0,0 +1,243 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package config_version
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net"
+	"strconv"
+	"strings"
+
+	"Wavelet/openflare/plugins/server/kernel/repository"
+
+	"Wavelet/openflare/plugins/server/kernel/model"
+)
+
+type customHeaderInput struct {
+	Key   string `json:"key"`
+	Value string `json:"value"`
+}
+
+func normalizeSnapshotDomains(domains []string) ([]string, error) {
+	normalized := make([]string, 0, len(domains))
+	seen := make(map[string]struct{}, len(domains))
+	for _, raw := range domains {
+		domain := strings.ToLower(strings.TrimSpace(raw))
+		if domain == "" || strings.Contains(domain, "://") || strings.Contains(domain, "/") {
+			return nil, errors.New("domains payload is invalid")
+		}
+		if _, ok := seen[domain]; ok {
+			continue
+		}
+		seen[domain] = struct{}{}
+		normalized = append(normalized, domain)
+	}
+	if len(normalized) == 0 {
+		return nil, errors.New("domain is required")
+	}
+	return normalized, nil
+}
+
+func isUniqueConstraintError(err error) bool {
+	if err == nil {
+		return false
+	}
+	return strings.Contains(strings.ToLower(err.Error()), "unique")
+}
+
+func decodeStoredUpstreams(raw string, fallbackOriginURL string) ([]string, error) {
+	text := strings.TrimSpace(raw)
+	if text == "" {
+		return normalizeUpstreams(fallbackOriginURL, nil)
+	}
+	var upstreams []string
+	if err := json.Unmarshal([]byte(text), &upstreams); err != nil {
+		return nil, errors.New("upstreams payload is invalid")
+	}
+	return normalizeUpstreams(fallbackOriginURL, upstreams)
+}
+
+func normalizeUpstreams(originURL string, upstreams []string) ([]string, error) {
+	candidates := upstreams
+	if len(candidates) == 0 {
+		candidates = []string{originURL}
+	}
+	normalized := make([]string, 0, len(candidates))
+	seen := make(map[string]struct{}, len(candidates))
+	for _, item := range candidates {
+		value := strings.TrimSpace(item)
+		if value == "" {
+			continue
+		}
+		if _, ok := seen[value]; ok {
+			continue
+		}
+		seen[value] = struct{}{}
+		normalized = append(normalized, value)
+	}
+	if len(normalized) == 0 {
+		return nil, errors.New("upstream is required")
+	}
+	return normalized, nil
+}
+
+func decodeStoredCustomHeaders(raw string) ([]customHeaderInput, error) {
+	text := strings.TrimSpace(raw)
+	if text == "" {
+		return []customHeaderInput{}, nil
+	}
+	var headers []customHeaderInput
+	if err := json.Unmarshal([]byte(text), &headers); err != nil {
+		return nil, errors.New("custom_headers payload is invalid")
+	}
+	return headers, nil
+}
+
+func decodeStoredCacheRules(raw string) ([]string, error) {
+	text := strings.TrimSpace(raw)
+	if text == "" {
+		return []string{}, nil
+	}
+	var rules []string
+	if err := json.Unmarshal([]byte(text), &rules); err != nil {
+		return nil, errors.New("cache_rules payload is invalid")
+	}
+	normalized := make([]string, 0, len(rules))
+	for _, rule := range rules {
+		item := strings.TrimSpace(rule)
+		if item == "" {
+			continue
+		}
+		normalized = append(normalized, item)
+	}
+	return normalized, nil
+}
+
+func normalizeUpstreamType(raw string) string {
+	value := strings.ToLower(strings.TrimSpace(raw))
+	switch value {
+	case "tunnel", "pages":
+		return value
+	default:
+		return "direct"
+	}
+}
+
+func normalizeTunnelTargetProtocol(raw string) string {
+	value := strings.ToLower(strings.TrimSpace(raw))
+	switch value {
+	case "http", "https", "tcp":
+		return value
+	default:
+		return "http"
+	}
+}
+
+func normalizePEM(content string) string {
+	return strings.TrimSpace(content) + "\n"
+}
+
+func certificateCertFileName(id uint) string {
+	return fmt.Sprintf("%d.crt", id)
+}
+
+func certificateKeyFileName(id uint) string {
+	return fmt.Sprintf("%d.key", id)
+}
+
+func dedupeSupportFiles(files []SupportFile) []SupportFile {
+	if len(files) == 0 {
+		return nil
+	}
+	unique := make(map[string]SupportFile, len(files))
+	for _, file := range files {
+		unique[file.Path] = file
+	}
+	result := make([]SupportFile, 0, len(unique))
+	for _, file := range unique {
+		result = append(result, file)
+	}
+	return result
+}
+
+func uintPtrEqual(left *uint, right *uint) bool {
+	if left == nil || right == nil {
+		return left == nil && right == nil
+	}
+	return *left == *right
+}
+
+func uintSliceEqual(left []uint, right []uint) bool {
+	if len(left) != len(right) {
+		return false
+	}
+	for index := range left {
+		if left[index] != right[index] {
+			return false
+		}
+	}
+	return true
+}
+
+func relayAgentAddress(node *model.OpenFlareNode) string {
+	if node == nil {
+		return ""
+	}
+	port := node.RelayVhostHTTPPort
+	if port <= 0 {
+		port = 8080
+	}
+	addr := strings.TrimSpace(node.RelayAgentAccessAddr)
+	if addr == "" {
+		addr = strings.TrimSpace(node.RelayClientAccessAddr)
+	}
+	if addr == "" {
+		addr = strings.TrimSpace(node.IP)
+	}
+	if addr == "" {
+		return fmt.Sprintf("127.0.0.1:%d", port)
+	}
+	if _, _, err := net.SplitHostPort(addr); err == nil {
+		return addr
+	}
+	if strings.Contains(addr, ":") && strings.Count(addr, ":") > 1 {
+		return net.JoinHostPort(addr, strconv.Itoa(port))
+	}
+	return fmt.Sprintf("%s:%d", addr, port)
+}
+
+func resolveTunnelOpenRestyUpstreamURL(ctx context.Context) string {
+	nodes, err := repository.ListOpenFlareNodes(ctx)
+	if err == nil {
+		for index := range nodes {
+			node := &nodes[index]
+			if node.NodeType != "tunnel_relay" {
+				continue
+			}
+			addr := relayAgentAddress(node)
+			if addr != "" {
+				return "http://" + addr
+			}
+		}
+	}
+	return "http://127.0.0.1:8080"
+}
+
+func listWAFIPGroupsByIDs(ctx context.Context, ids []uint) ([]*model.OpenFlareWAFIPGroup, error) {
+	if len(ids) == 0 {
+		return []*model.OpenFlareWAFIPGroup{}, nil
+	}
+	groups := make([]*model.OpenFlareWAFIPGroup, 0, len(ids))
+	for _, id := range ids {
+		group, err := repository.GetOpenFlareWAFIPGroupByID(ctx, id)
+		if err != nil {
+			return nil, err
+		}
+		groups = append(groups, group)
+	}
+	return groups, nil
+}

backend/openflare/plugins/server/domain/site/config_version/logics.go

@@ -0,0 +1,627 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package config_version
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"slices"
+	"sort"
+	"strconv"
+	"strings"
+	"time"
+
+	"Wavelet/openflare/plugins/server/kernel/repository"
+
+	"Wavelet/openflare/plugins/server/domain/fleet/websocket"
+	"Wavelet/openflare/plugins/server/kernel/model"
+	pkgprotocol "Wavelet/openflare/share/protocol"
+	openrestyrender "Wavelet/openflare/share/render/openresty"
+
+	"gorm.io/gorm"
+)
+
+const (
+	cleanupSuccessMessage     = "清理成功"
+	minConfigVersionKeepCount = 3
+)
+
+// ConfigPreviewResult is the preview response payload.
+type ConfigPreviewResult struct {
+	SnapshotJSON   string        `json:"snapshot_json"`
+	MainConfig     string        `json:"main_config"`
+	RouteConfig    string        `json:"route_config"`
+	RenderedConfig string        `json:"rendered_config"`
+	SupportFiles   []SupportFile `json:"support_files"`
+	Checksum       string        `json:"checksum"`
+	RouteCount     int           `json:"route_count"`
+	WebsiteCount   int           `json:"website_count"`
+}
+
+// ConfigDiffResult is the diff response payload.
+type ConfigDiffResult struct {
+	ActiveVersion        string                 `json:"active_version,omitempty"`
+	AddedSites           []string               `json:"added_sites"`
+	RemovedSites         []string               `json:"removed_sites"`
+	ModifiedSites        []string               `json:"modified_sites"`
+	AddedDomains         []string               `json:"added_domains"`
+	RemovedDomains       []string               `json:"removed_domains"`
+	ModifiedDomains      []string               `json:"modified_domains"`
+	MainConfigChanged    bool                   `json:"main_config_changed"`
+	WAFConfigChanged     bool                   `json:"waf_config_changed"`
+	ChangedOptionKeys    []string               `json:"changed_option_keys"`
+	ChangedOptionDetails []ConfigOptionDiffItem `json:"changed_option_details"`
+	CurrentWebsiteCount  int                    `json:"current_website_count"`
+	ActiveWebsiteCount   int                    `json:"active_website_count"`
+}
+
+// ConfigOptionDiffItem describes a changed OpenResty option.
+type ConfigOptionDiffItem struct {
+	Key           string `json:"key"`
+	PreviousValue string `json:"previous_value"`
+	CurrentValue  string `json:"current_value"`
+}
+
+// CleanupInput is the cleanup request payload.
+type CleanupInput struct {
+	KeepCount int `json:"keep_count"`
+}
+
+// CleanupResult is the cleanup response payload.
+type CleanupResult struct {
+	DeletedCount int64  `json:"deleted_count"`
+	Message      string `json:"message"`
+}
+
+// ListConfigVersions returns all config version summaries.
+func ListConfigVersions(ctx context.Context) ([]*model.ConfigVersionSummary, error) {
+	return repository.ListConfigVersionSummaries(ctx)
+}
+
+// GetConfigVersionDetail returns a config version by version.
+func GetConfigVersionDetail(ctx context.Context, version string) (*model.ConfigVersion, error) {
+	return repository.GetConfigVersionByVersion(ctx, version)
+}
+
+// GetActiveConfigVersion returns the active config version.
+func GetActiveConfigVersion(ctx context.Context) (*model.ConfigVersion, error) {
+	return repository.GetActiveConfigVersion(ctx)
+}
+
+// PreviewConfigVersion renders the current draft configuration.
+func PreviewConfigVersion(ctx context.Context) (*ConfigPreviewResult, error) {
+	bundle, err := buildCurrentConfigBundle(ctx, false)
+	if err != nil {
+		return nil, err
+	}
+	return &ConfigPreviewResult{
+		SnapshotJSON:   bundle.SnapshotJSON,
+		MainConfig:     bundle.MainConfig,
+		RouteConfig:    bundle.RouteConfig,
+		RenderedConfig: bundle.RouteConfig,
+		SupportFiles:   bundle.SupportFiles,
+		Checksum:       bundle.Checksum,
+		RouteCount:     len(bundle.Routes),
+		WebsiteCount:   len(bundle.SnapshotRoutes),
+	}, nil
+}
+
+// DiffConfigVersion compares the current draft against the active version.
+func DiffConfigVersion(ctx context.Context) (*ConfigDiffResult, error) {
+	bundle, err := buildCurrentConfigBundle(ctx, false)
+	if err != nil {
+		return nil, err
+	}
+	result := &ConfigDiffResult{
+		AddedSites:           []string{},
+		RemovedSites:         []string{},
+		ModifiedSites:        []string{},
+		AddedDomains:         []string{},
+		RemovedDomains:       []string{},
+		ModifiedDomains:      []string{},
+		ChangedOptionKeys:    []string{},
+		ChangedOptionDetails: []ConfigOptionDiffItem{},
+		CurrentWebsiteCount:  len(bundle.SnapshotRoutes),
+	}
+	activeVersion, err := repository.GetActiveConfigVersion(ctx)
+	if err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			for _, route := range bundle.SnapshotRoutes {
+				result.AddedSites = append(result.AddedSites, route.SiteName)
+				result.AddedDomains = append(result.AddedDomains, route.Domains...)
+			}
+			result.MainConfigChanged = true
+			result.ChangedOptionKeys = openRestyOptionKeys()
+			result.ChangedOptionDetails = buildInitialOpenRestyOptionDiffs(bundle.OpenRestyConfig)
+			sort.Strings(result.AddedSites)
+			sort.Strings(result.AddedDomains)
+			sort.Strings(result.ChangedOptionKeys)
+			return result, nil
+		}
+		return nil, err
+	}
+	result.ActiveVersion = activeVersion.Version
+	activeSnapshot, err := parseSnapshotDocument(activeVersion.SnapshotJSON)
+	if err != nil {
+		return nil, err
+	}
+	result.ActiveWebsiteCount = len(activeSnapshot.Routes)
+	currentSiteMap := flattenSnapshotRoutesBySite(bundle.SnapshotRoutes)
+	activeSiteMap := flattenSnapshotRoutesBySite(activeSnapshot.Routes)
+	for siteName, currentRoute := range currentSiteMap {
+		activeRoute, ok := activeSiteMap[siteName]
+		if !ok {
+			result.AddedSites = append(result.AddedSites, siteName)
+			continue
+		}
+		if !snapshotRouteConfigEqual(activeRoute, currentRoute) {
+			result.ModifiedSites = append(result.ModifiedSites, siteName)
+		}
+	}
+	for siteName := range activeSiteMap {
+		if _, ok := currentSiteMap[siteName]; !ok {
+			result.RemovedSites = append(result.RemovedSites, siteName)
+		}
+	}
+	currentMap := flattenSnapshotRoutesByDomain(bundle.SnapshotRoutes)
+	activeMap := flattenSnapshotRoutesByDomain(activeSnapshot.Routes)
+	for domain, currentRoute := range currentMap {
+		activeRoute, ok := activeMap[domain]
+		if !ok {
+			result.AddedDomains = append(result.AddedDomains, domain)
+			continue
+		}
+		if !snapshotRouteConfigEqual(activeRoute, currentRoute) {
+			result.ModifiedDomains = append(result.ModifiedDomains, domain)
+		}
+	}
+	for domain := range activeMap {
+		if _, ok := currentMap[domain]; !ok {
+			result.RemovedDomains = append(result.RemovedDomains, domain)
+		}
+	}
+	result.MainConfigChanged = activeVersion.MainConfig != bundle.MainConfig
+	result.WAFConfigChanged = !snapshotWAFConfigEqual(activeSnapshot.WAF, bundle.WAFSnapshot)
+	result.ChangedOptionDetails = diffOpenRestyOptionDetails(activeSnapshot.OpenRestyConfig, bundle.OpenRestyConfig)
+	result.ChangedOptionKeys = extractOptionDiffKeys(result.ChangedOptionDetails)
+	sort.Strings(result.AddedSites)
+	sort.Strings(result.RemovedSites)
+	sort.Strings(result.ModifiedSites)
+	sort.Strings(result.AddedDomains)
+	sort.Strings(result.RemovedDomains)
+	sort.Strings(result.ModifiedDomains)
+	sort.Strings(result.ChangedOptionKeys)
+	return result, nil
+}
+
+// PublishConfigVersion publishes the current draft as a new active version.
+func PublishConfigVersion(ctx context.Context, createdBy string, force bool) (*model.ConfigVersion, error) {
+	bundle, err := buildCurrentConfigBundle(ctx, true)
+	if err != nil {
+		return nil, err
+	}
+	if len(bundle.Routes) == 0 {
+		return nil, errors.New(errNoEnabledRoutes)
+	}
+	activeVersion, err := repository.GetActiveConfigVersion(ctx)
+	if !force && err == nil && activeVersion.Checksum == bundle.Checksum {
+		return nil, errors.New(errNoChangesToPublish)
+	}
+	if err != nil && !errors.Is(err, gorm.ErrRecordNotFound) {
+		return nil, err
+	}
+	supportFilesJSON, err := json.Marshal(bundle.SupportFiles)
+	if err != nil {
+		return nil, err
+	}
+	version, err := nextVersionNumber(ctx, time.Now())
+	if err != nil {
+		return nil, err
+	}
+	record := &model.ConfigVersion{
+		Version:          version,
+		SnapshotJSON:     bundle.SnapshotJSON,
+		MainConfig:       bundle.MainConfig,
+		RenderedConfig:   bundle.RouteConfig,
+		SupportFilesJSON: string(supportFilesJSON),
+		Checksum:         bundle.Checksum,
+		IsActive:         true,
+		CreatedBy:        createdBy,
+	}
+	if err = repository.PublishConfigVersionTx(ctx, record); err != nil {
+		if isUniqueConstraintError(err) {
+			return nil, errors.New(errVersionConflict)
+		}
+		return nil, err
+	}
+	websocket.BroadcastActiveConfig(pkgprotocol.ActiveConfigMeta{
+		Version:  record.Version,
+		Checksum: record.Checksum,
+	})
+	return record, nil
+}
+
+// ActivateConfigVersion activates an existing config version.
+func ActivateConfigVersion(ctx context.Context, versionStr string) (*model.ConfigVersion, error) {
+	version, err := repository.GetConfigVersionByVersion(ctx, versionStr)
+	if err != nil {
+		return nil, err
+	}
+	if err = repository.ActivateConfigVersionTx(ctx, versionStr); err != nil {
+		return nil, err
+	}
+	version.IsActive = true
+	websocket.BroadcastActiveConfig(pkgprotocol.ActiveConfigMeta{
+		Version:  version.Version,
+		Checksum: version.Checksum,
+	})
+	return version, nil
+}
+
+// CleanupConfigVersions removes old inactive config versions.
+func CleanupConfigVersions(ctx context.Context, keepCount int) (*CleanupResult, error) {
+	if keepCount < minConfigVersionKeepCount {
+		keepCount = minConfigVersionKeepCount
+	}
+	versions, err := repository.ListConfigVersionSummaries(ctx)
+	if err != nil {
+		return nil, err
+	}
+	if len(versions) <= keepCount {
+		return &CleanupResult{DeletedCount: 0, Message: cleanupSuccessMessage}, nil
+	}
+	var deleteVersions []string
+	for index, version := range versions {
+		if index < keepCount {
+			continue
+		}
+		if version.IsActive {
+			continue
+		}
+		deleteVersions = append(deleteVersions, version.Version)
+	}
+	if len(deleteVersions) == 0 {
+		return &CleanupResult{DeletedCount: 0, Message: cleanupSuccessMessage}, nil
+	}
+	deletedCount, err := repository.DeleteConfigVersionsByVersions(ctx, deleteVersions)
+	if err != nil {
+		return nil, err
+	}
+	return &CleanupResult{DeletedCount: deletedCount, Message: cleanupSuccessMessage}, nil
+}
+
+func nextVersionNumber(ctx context.Context, now time.Time) (string, error) {
+	prefix := now.Format("20060102")
+	latest, err := repository.GetLatestConfigVersionByPrefix(ctx, prefix)
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		return fmt.Sprintf("%s-%03d", prefix, 1), nil
+	}
+	if err != nil {
+		return "", err
+	}
+	suffix := strings.TrimPrefix(latest, prefix+"-")
+	sequence, err := strconv.Atoi(suffix)
+	if err != nil {
+		return "", fmt.Errorf("invalid config version sequence %q: %w", latest, err)
+	}
+	return fmt.Sprintf("%s-%03d", prefix, sequence+1), nil
+}
+
+func parseSnapshotDocument(snapshotJSON string) (*snapshotDocument, error) {
+	text := strings.TrimSpace(snapshotJSON)
+	if text == "" {
+		return &snapshotDocument{Routes: []snapshotRoute{}}, nil
+	}
+	if strings.HasPrefix(text, "[") {
+		var routes []snapshotRoute
+		if err := json.Unmarshal([]byte(text), &routes); err != nil {
+			return nil, errors.New(errInvalidSnapshotFormat)
+		}
+		return &snapshotDocument{Routes: normalizeSnapshotRoutes(routes)}, nil
+	}
+	var snapshot snapshotDocument
+	if err := json.Unmarshal([]byte(text), &snapshot); err != nil {
+		return nil, errors.New(errInvalidSnapshotFormat)
+	}
+	snapshot.Routes = normalizeSnapshotRoutes(snapshot.Routes)
+	return &snapshot, nil
+}
+
+func normalizeSnapshotRoutes(routes []snapshotRoute) []snapshotRoute {
+	if len(routes) == 0 {
+		return []snapshotRoute{}
+	}
+	for index := range routes {
+		normalizedDomains, err := normalizeSnapshotDomains(routes[index].Domains)
+		if err == nil && len(normalizedDomains) > 0 {
+			routes[index].Domains = normalizedDomains
+			routes[index].SiteName = strings.TrimSpace(routes[index].SiteName)
+		}
+		normalizedUpstreams, upstreamErr := normalizeUpstreams(routes[index].OriginURL, routes[index].Upstreams)
+		if upstreamErr == nil {
+			routes[index].OriginURL = normalizedUpstreams[0]
+			routes[index].Upstreams = normalizedUpstreams
+		}
+		if !routes[index].BasicAuthEnabled {
+			routes[index].BasicAuthUsername = ""
+			routes[index].BasicAuthPassword = ""
+		}
+		routes[index].UpstreamType = normalizeUpstreamType(routes[index].UpstreamType)
+		routes[index].CachePolicy = normalizeSnapshotCachePolicy(
+			routes[index].CacheEnabled,
+			routes[index].CachePolicy,
+		)
+		if !routes[index].CacheEnabled {
+			routes[index].CacheRules = nil
+		}
+	}
+	return routes
+}
+
+// normalizeSnapshotCachePolicy aligns published policy with edge-cache-design:
+// legacy empty/url → all; disabled → empty; static/suffix/... kept.
+func normalizeSnapshotCachePolicy(enabled bool, raw string) string {
+	if !enabled {
+		return ""
+	}
+	policy := strings.TrimSpace(strings.ToLower(raw))
+	switch policy {
+	case "", "url", "all":
+		return "all"
+	case "static", "suffix", "path_prefix", "path_exact":
+		return policy
+	default:
+		// Unknown: prefer static over caching everything.
+		return "static"
+	}
+}
+
+func flattenSnapshotRoutesBySite(routes []snapshotRoute) map[string]snapshotRoute {
+	siteMap := make(map[string]snapshotRoute)
+	for _, route := range normalizeSnapshotRoutes(routes) {
+		siteMap[route.SiteName] = route
+	}
+	return siteMap
+}
+
+func flattenSnapshotRoutesByDomain(routes []snapshotRoute) map[string]snapshotRoute {
+	domainMap := make(map[string]snapshotRoute)
+	for _, route := range normalizeSnapshotRoutes(routes) {
+		for _, domain := range route.Domains {
+			item := route
+			domainMap[domain] = item
+		}
+	}
+	return domainMap
+}
+
+func snapshotRouteConfigEqual(left snapshotRoute, right snapshotRoute) bool {
+	return snapshotRouteScalarsEqual(left, right) &&
+		slices.Equal(left.Domains, right.Domains) &&
+		slices.Equal(left.Upstreams, right.Upstreams) &&
+		slices.Equal(left.CacheRules, right.CacheRules) &&
+		slices.Equal(left.CustomHeaders, right.CustomHeaders)
+}
+
+func snapshotRouteScalarsEqual(left, right snapshotRoute) bool {
+	return snapshotRouteIdentityEqual(left, right) &&
+		snapshotRouteOriginEqual(left, right) &&
+		snapshotRoutePolicyEqual(left, right) &&
+		snapshotRouteTunnelEqual(left, right) &&
+		uintSliceEqual(left.DomainCertIDs, right.DomainCertIDs)
+}
+
+func snapshotRouteIdentityEqual(left, right snapshotRoute) bool {
+	return left.SiteName == right.SiteName
+}
+
+func snapshotRouteOriginEqual(left, right snapshotRoute) bool {
+	return left.OriginURL == right.OriginURL &&
+		left.OriginHost == right.OriginHost &&
+		left.UpstreamType == right.UpstreamType &&
+		snapshotPagesDeploymentEqual(left.PagesDeployment, right.PagesDeployment)
+}
+
+func snapshotPagesDeploymentEqual(left, right *openrestyrender.PagesDeployment) bool {
+	if left == nil && right == nil {
+		return true
+	}
+	if left == nil || right == nil {
+		return false
+	}
+	leftJSON, err := json.Marshal(left)
+	if err != nil {
+		return false
+	}
+	rightJSON, err := json.Marshal(right)
+	if err != nil {
+		return false
+	}
+	return string(leftJSON) == string(rightJSON)
+}
+
+func snapshotRoutePolicyEqual(left, right snapshotRoute) bool {
+	return left.EnableHTTPS == right.EnableHTTPS &&
+		left.RedirectHTTP == right.RedirectHTTP &&
+		left.LimitConnPerServer == right.LimitConnPerServer &&
+		left.LimitConnPerIP == right.LimitConnPerIP &&
+		left.LimitRate == right.LimitRate &&
+		left.CacheEnabled == right.CacheEnabled &&
+		left.CachePolicy == right.CachePolicy &&
+		left.BasicAuthEnabled == right.BasicAuthEnabled &&
+		left.BasicAuthUsername == right.BasicAuthUsername &&
+		left.BasicAuthPassword == right.BasicAuthPassword
+}
+
+func snapshotRouteTunnelEqual(left, right snapshotRoute) bool {
+	return left.TunnelTargetAddr == right.TunnelTargetAddr &&
+		left.TunnelTargetProto == right.TunnelTargetProto &&
+		uintPtrEqual(left.TunnelNodeID, right.TunnelNodeID) &&
+		uintPtrEqual(left.PagesProjectID, right.PagesProjectID)
+}
+
+func snapshotWAFConfigEqual(left snapshotWAFDocument, right snapshotWAFDocument) bool {
+	leftJSON, err := json.Marshal(left)
+	if err != nil {
+		return false
+	}
+	rightJSON, err := json.Marshal(right)
+	if err != nil {
+		return false
+	}
+	return string(leftJSON) == string(rightJSON)
+}
+
+func buildInitialOpenRestyOptionDiffs(current openRestyConfigSnapshot) []ConfigOptionDiffItem {
+	details := diffOpenRestyOptionDetails(openRestyConfigSnapshot{}, current)
+	for index := range details {
+		details[index].PreviousValue = ""
+	}
+	return details
+}
+
+func diffOpenRestyOptionDetails(left openRestyConfigSnapshot, right openRestyConfigSnapshot) []ConfigOptionDiffItem {
+	changes := make([]ConfigOptionDiffItem, 0)
+	appendIfChanged := func(key string, previous string, current string) {
+		if previous == current {
+			return
+		}
+		changes = append(changes, ConfigOptionDiffItem{
+			Key:           key,
+			PreviousValue: previous,
+			CurrentValue:  current,
+		})
+	}
+	appendIfChanged("OpenRestyDefaultServerReturnStatus", strconv.Itoa(left.DefaultServerReturnStatus), strconv.Itoa(right.DefaultServerReturnStatus))
+	appendIfChanged("OpenRestyWorkerProcesses", left.WorkerProcesses, right.WorkerProcesses)
+	appendIfChanged("OpenRestyWorkerConnections", strconv.Itoa(left.WorkerConnections), strconv.Itoa(right.WorkerConnections))
+	appendIfChanged("OpenRestyWorkerRlimitNofile", strconv.Itoa(left.WorkerRlimitNofile), strconv.Itoa(right.WorkerRlimitNofile))
+	appendIfChanged("OpenRestyEventsUse", left.EventsUse, right.EventsUse)
+	appendIfChanged("OpenRestyEventsMultiAcceptEnabled", strconv.FormatBool(left.EventsMultiAcceptEnabled), strconv.FormatBool(right.EventsMultiAcceptEnabled))
+	appendIfChanged("OpenRestyKeepaliveTimeout", strconv.Itoa(left.KeepaliveTimeout), strconv.Itoa(right.KeepaliveTimeout))
+	appendIfChanged("OpenRestyKeepaliveRequests", strconv.Itoa(left.KeepaliveRequests), strconv.Itoa(right.KeepaliveRequests))
+	appendIfChanged("OpenRestyClientHeaderTimeout", strconv.Itoa(left.ClientHeaderTimeout), strconv.Itoa(right.ClientHeaderTimeout))
+	appendIfChanged("OpenRestyClientBodyTimeout", strconv.Itoa(left.ClientBodyTimeout), strconv.Itoa(right.ClientBodyTimeout))
+	appendIfChanged("OpenRestyClientMaxBodySize", left.ClientMaxBodySize, right.ClientMaxBodySize)
+	appendIfChanged("OpenRestyLargeClientHeaderBuffers", left.LargeClientHeaderBuffers, right.LargeClientHeaderBuffers)
+	appendIfChanged("OpenRestySendTimeout", strconv.Itoa(left.SendTimeout), strconv.Itoa(right.SendTimeout))
+	appendIfChanged("OpenRestyProxyConnectTimeout", strconv.Itoa(left.ProxyConnectTimeout), strconv.Itoa(right.ProxyConnectTimeout))
+	appendIfChanged("OpenRestyProxySendTimeout", strconv.Itoa(left.ProxySendTimeout), strconv.Itoa(right.ProxySendTimeout))
+	appendIfChanged("OpenRestyProxyReadTimeout", strconv.Itoa(left.ProxyReadTimeout), strconv.Itoa(right.ProxyReadTimeout))
+	appendIfChanged("OpenRestyWebsocketEnabled", strconv.FormatBool(left.WebsocketEnabled), strconv.FormatBool(right.WebsocketEnabled))
+	appendIfChanged("OpenRestyHTTP3Enabled", strconv.FormatBool(left.HTTP3Enabled), strconv.FormatBool(right.HTTP3Enabled))
+	appendIfChanged("OpenRestyProxyRequestBufferingEnabled", strconv.FormatBool(left.ProxyRequestBuffering), strconv.FormatBool(right.ProxyRequestBuffering))
+	appendIfChanged("OpenRestyProxyBufferingEnabled", strconv.FormatBool(left.ProxyBufferingEnabled), strconv.FormatBool(right.ProxyBufferingEnabled))
+	appendIfChanged("OpenRestyProxyBuffers", left.ProxyBuffers, right.ProxyBuffers)
+	appendIfChanged("OpenRestyProxyBufferSize", left.ProxyBufferSize, right.ProxyBufferSize)
+	appendIfChanged("OpenRestyProxyBusyBuffersSize", left.ProxyBusyBuffersSize, right.ProxyBusyBuffersSize)
+	appendIfChanged("OpenRestyGzipEnabled", strconv.FormatBool(left.GzipEnabled), strconv.FormatBool(right.GzipEnabled))
+	appendIfChanged("OpenRestyGzipMinLength", strconv.Itoa(left.GzipMinLength), strconv.Itoa(right.GzipMinLength))
+	appendIfChanged("OpenRestyGzipCompLevel", strconv.Itoa(left.GzipCompLevel), strconv.Itoa(right.GzipCompLevel))
+	appendIfChanged("OpenRestyResolvers", left.Resolvers, right.Resolvers)
+	appendIfChanged("OpenRestyCacheEnabled", strconv.FormatBool(left.CacheEnabled), strconv.FormatBool(right.CacheEnabled))
+	appendIfChanged("OpenRestyCachePath", left.CachePath, right.CachePath)
+	appendIfChanged("OpenRestyCacheLevels", left.CacheLevels, right.CacheLevels)
+	appendIfChanged("OpenRestyCacheInactive", left.CacheInactive, right.CacheInactive)
+	appendIfChanged("OpenRestyCacheMaxSize", left.CacheMaxSize, right.CacheMaxSize)
+	appendIfChanged("OpenRestyCacheKeyTemplate", left.CacheKeyTemplate, right.CacheKeyTemplate)
+	appendIfChanged("OpenRestyCacheLockEnabled", strconv.FormatBool(left.CacheLockEnabled), strconv.FormatBool(right.CacheLockEnabled))
+	appendIfChanged("OpenRestyCacheLockTimeout", left.CacheLockTimeout, right.CacheLockTimeout)
+	appendIfChanged("OpenRestyCacheUseStale", left.CacheUseStale, right.CacheUseStale)
+	appendIfChanged("OpenRestyDefaultLimitConnPerServer", strconv.Itoa(left.DefaultLimitConnPerServer), strconv.Itoa(right.DefaultLimitConnPerServer))
+	appendIfChanged("OpenRestyDefaultLimitConnPerIP", strconv.Itoa(left.DefaultLimitConnPerIP), strconv.Itoa(right.DefaultLimitConnPerIP))
+	appendIfChanged("OpenRestyDefaultLimitRate", left.DefaultLimitRate, right.DefaultLimitRate)
+	appendIfChanged("OpenRestyDefaultLimitReqPerIP", left.DefaultLimitReqPerIP, right.DefaultLimitReqPerIP)
+	appendIfChanged("OriginErrorPageEnabled", strconv.FormatBool(left.OriginErrorPageEnabled), strconv.FormatBool(right.OriginErrorPageEnabled))
+	appendIfChanged("OriginErrorPageStatusCodes", encodeOriginErrorPageStatusCodes(left.OriginErrorPageStatusCodes), encodeOriginErrorPageStatusCodes(right.OriginErrorPageStatusCodes))
+	appendIfChanged("OriginErrorPageHTML", left.OriginErrorPageHTML, right.OriginErrorPageHTML)
+	appendIfChanged("OriginErrorPageGetOnly", strconv.FormatBool(left.OriginErrorPageGetOnly), strconv.FormatBool(right.OriginErrorPageGetOnly))
+	appendIfChanged("SWOfflineEnabled", strconv.FormatBool(left.SWOfflineEnabled), strconv.FormatBool(right.SWOfflineEnabled))
+	appendIfChanged("SWOfflineHTML", left.SWOfflineHTML, right.SWOfflineHTML)
+	appendIfChanged("SWOfflineDomains", encodeSWOfflineDomains(left.SWOfflineDomains), encodeSWOfflineDomains(right.SWOfflineDomains))
+	return changes
+}
+
+func encodeOriginErrorPageStatusCodes(tags []string) string {
+	if len(tags) == 0 {
+		return ""
+	}
+	payload, err := json.Marshal(tags)
+	if err != nil {
+		return strings.Join(tags, ",")
+	}
+	return string(payload)
+}
+
+func encodeSWOfflineDomains(domains []string) string {
+	if len(domains) == 0 {
+		return ""
+	}
+	payload, err := json.Marshal(domains)
+	if err != nil {
+		return strings.Join(domains, ",")
+	}
+	return string(payload)
+}
+
+func extractOptionDiffKeys(details []ConfigOptionDiffItem) []string {
+	keys := make([]string, 0, len(details))
+	for _, item := range details {
+		keys = append(keys, item.Key)
+	}
+	return keys
+}
+
+func openRestyOptionKeys() []string {
+	return []string{
+		"OpenRestyDefaultServerReturnStatus",
+		"OpenRestyWorkerProcesses",
+		"OpenRestyWorkerConnections",
+		"OpenRestyWorkerRlimitNofile",
+		"OpenRestyEventsUse",
+		"OpenRestyEventsMultiAcceptEnabled",
+		"OpenRestyKeepaliveTimeout",
+		"OpenRestyKeepaliveRequests",
+		"OpenRestyClientHeaderTimeout",
+		"OpenRestyClientBodyTimeout",
+		"OpenRestyClientMaxBodySize",
+		"OpenRestyLargeClientHeaderBuffers",
+		"OpenRestySendTimeout",
+		"OpenRestyProxyConnectTimeout",
+		"OpenRestyProxySendTimeout",
+		"OpenRestyProxyReadTimeout",
+		"OpenRestyWebsocketEnabled",
+		"OpenRestyHTTP3Enabled",
+		"OpenRestyProxyRequestBufferingEnabled",
+		"OpenRestyProxyBufferingEnabled",
+		"OpenRestyProxyBuffers",
+		"OpenRestyProxyBufferSize",
+		"OpenRestyProxyBusyBuffersSize",
+		"OpenRestyGzipEnabled",
+		"OpenRestyGzipMinLength",
+		"OpenRestyGzipCompLevel",
+		"OpenRestyCacheEnabled",
+		"OpenRestyCachePath",
+		"OpenRestyCacheLevels",
+		"OpenRestyCacheInactive",
+		"OpenRestyCacheMaxSize",
+		"OpenRestyCacheKeyTemplate",
+		"OpenRestyCacheLockEnabled",
+		"OpenRestyCacheLockTimeout",
+		"OpenRestyCacheUseStale",
+		"OpenRestyDefaultLimitConnPerServer",
+		"OpenRestyDefaultLimitConnPerIP",
+		"OpenRestyDefaultLimitRate",
+		"OpenRestyDefaultLimitReqPerIP",
+		"OriginErrorPageEnabled",
+		"OriginErrorPageStatusCodes",
+		"OriginErrorPageHTML",
+		"OriginErrorPageGetOnly",
+		"SWOfflineEnabled",
+		"SWOfflineHTML",
+		"SWOfflineDomains",
+	}
+}

backend/openflare/plugins/server/domain/site/config_version/logics_test.go

@@ -0,0 +1,248 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package config_version
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"testing"
+	"time"
+
+	"Wavelet/openflare/plugins/server/kernel/repository"
+
+	"Wavelet/openflare/plugins/server/domain/waf"
+	"Wavelet/openflare/plugins/server/kernel/model"
+	openrestyrender "Wavelet/openflare/share/render/openresty"
+	"Wavelet/pkg/cache/ram"
+	db "Wavelet/plugins/infra/database"
+
+	"github.com/glebarez/sqlite"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"gorm.io/gorm"
+)
+
+func setupConfigVersionTestDB(t *testing.T) func() {
+	t.Helper()
+
+	// 同 origin_error_page_snapshot_test.go：换 DB 前后重置进程级 RAM 配置缓存。
+	ram.ResetForTest()
+
+	sqliteDB, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{
+		DisableForeignKeyConstraintWhenMigrating: true,
+	})
+	require.NoError(t, err)
+	require.NoError(t, sqliteDB.AutoMigrate(
+		&model.ProxyRoute{},
+		&model.Zone{},
+		&model.ZoneDomain{},
+		&model.ConfigVersion{},
+		&model.OpenFlareWAFRuleGroup{},
+		&model.OpenFlareWAFRuleGroupBinding{},
+		&model.OpenFlareWAFIPGroup{},
+		&model.SystemConfig{},
+	))
+
+	db.SetDB(sqliteDB)
+	return func() {
+		db.SetDB(nil)
+		ram.ResetForTest()
+	}
+}
+
+func createSnapshotZoneDomains(t *testing.T, ctx context.Context, route *model.ProxyRoute, domains ...string) {
+	t.Helper()
+	zone := &model.Zone{Domain: fmt.Sprintf("zone-%d.example", route.ID)}
+	require.NoError(t, db.DB(ctx).Create(zone).Error)
+	for _, domain := range domains {
+		require.NoError(t, db.DB(ctx).Create(&model.ZoneDomain{
+			ZoneID:       zone.ID,
+			ProxyRouteID: &route.ID,
+			Domain:       domain,
+		}).Error)
+	}
+}
+
+func TestListConfigVersionsOrdersByCreatedAtDesc(t *testing.T) {
+	cleanup := setupConfigVersionTestDB(t)
+	defer cleanup()
+	ctx := context.Background()
+	conn := db.DB(ctx)
+	require.NotNil(t, conn)
+
+	newer := &model.ConfigVersion{
+		Version:        "20260102-001",
+		SnapshotJSON:   "{}",
+		RenderedConfig: "route {}",
+		Checksum:       "checksum-newer",
+		CreatedBy:      "tester",
+		CreatedAt:      time.Date(2026, 1, 2, 12, 0, 0, 0, time.UTC),
+	}
+	older := &model.ConfigVersion{
+		Version:        "20260101-001",
+		SnapshotJSON:   "{}",
+		RenderedConfig: "route {}",
+		Checksum:       "checksum-older",
+		CreatedBy:      "tester",
+		CreatedAt:      time.Date(2026, 1, 1, 12, 0, 0, 0, time.UTC),
+	}
+	require.NoError(t, conn.Create(newer).Error)
+	require.NoError(t, conn.Create(older).Error)
+
+	versions, err := ListConfigVersions(ctx)
+	require.NoError(t, err)
+	require.Len(t, versions, 2)
+	assert.Equal(t, newer.Version, versions[0].Version)
+	assert.Equal(t, older.Version, versions[1].Version)
+}
+
+func TestPublishConfigVersionCreatesVersion(t *testing.T) {
+	cleanup := setupConfigVersionTestDB(t)
+	defer cleanup()
+	ctx := context.Background()
+
+	route := &model.ProxyRoute{
+		SiteName:  "publish-site",
+		OriginURL: "http://origin.publish.example.com:8080",
+		Upstreams: `["http://origin.publish.example.com:8080"]`,
+		Enabled:   true,
+	}
+	require.NoError(t, repository.CreateProxyRouteRecord(ctx, route))
+	createSnapshotZoneDomains(t, ctx, route, "publish.example.com")
+
+	version, err := PublishConfigVersion(ctx, "tester", false)
+	require.NoError(t, err)
+	require.NotNil(t, version)
+	assert.NotEmpty(t, version.ID)
+	assert.True(t, version.IsActive)
+	assert.Equal(t, "tester", version.CreatedBy)
+	assert.NotEmpty(t, version.Version)
+	assert.NotEmpty(t, version.Checksum)
+	assert.NotEmpty(t, version.SnapshotJSON)
+	assert.NotEmpty(t, version.RenderedConfig)
+
+	var snapshot snapshotDocument
+	require.NoError(t, json.Unmarshal([]byte(version.SnapshotJSON), &snapshot))
+	require.Len(t, snapshot.Routes, 1)
+	assert.Equal(t, "publish-site", snapshot.Routes[0].SiteName)
+	assert.Equal(t, []string{"publish.example.com"}, snapshot.Routes[0].Domains)
+
+	active, err := GetActiveConfigVersion(ctx)
+	require.NoError(t, err)
+	assert.Equal(t, version.ID, active.ID)
+
+	_, err = PublishConfigVersion(ctx, "tester", false)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), errNoChangesToPublish)
+
+	forced, err := PublishConfigVersion(ctx, "tester", true)
+	require.NoError(t, err)
+	assert.NotEqual(t, version.ID, forced.ID)
+}
+
+func TestBuildSnapshotWAFDocumentUsesNormalizedSiteNames(t *testing.T) {
+	cleanup := setupConfigVersionTestDB(t)
+	defer cleanup()
+	ctx := context.Background()
+
+	route := &model.ProxyRoute{
+		SiteName:  "example.com",
+		OriginURL: "http://origin.example.com:8080",
+		Upstreams: `["http://origin.example.com:8080"]`,
+		Enabled:   true,
+	}
+	require.NoError(t, repository.CreateProxyRouteRecord(ctx, route))
+	createSnapshotZoneDomains(t, ctx, route, "example.com", "www.example.com")
+
+	require.NoError(t, waf.EnsureDefaultRuleGroup(ctx))
+	globalGroup, err := repository.GetGlobalOpenFlareWAFRuleGroup(ctx)
+	require.NoError(t, err)
+
+	customGroup := createSnapshotRule(t, ctx, "pow-group", waf.DefaultRuleGraph())
+	require.NoError(t, repository.ReplaceOpenFlareWAFRuleGroupBindings(ctx, customGroup.ID, []uint{route.ID}))
+
+	bundle, err := buildCurrentConfigBundle(ctx, true)
+	require.NoError(t, err)
+	require.Len(t, bundle.SnapshotRoutes, 1)
+	assert.Equal(t, "example.com", bundle.SnapshotRoutes[0].SiteName)
+
+	require.NotEmpty(t, bundle.WAFSnapshot.Bindings)
+	found := false
+	for _, binding := range bundle.WAFSnapshot.Bindings {
+		if binding.RouteID != route.ID {
+			continue
+		}
+		found = true
+		assert.Equal(t, "example.com", binding.SiteName)
+		assert.Contains(t, binding.RuleGroupIDs, customGroup.ID)
+	}
+	assert.True(t, found, "expected WAF binding for enabled route")
+
+	var wafRuntime openrestyrender.WAFDocument
+	foundWAFConfig := false
+	for _, file := range bundle.SupportFiles {
+		if file.Path != "waf_config.json" {
+			continue
+		}
+		foundWAFConfig = true
+		require.NoError(t, json.Unmarshal([]byte(file.Content), &wafRuntime))
+	}
+	require.True(t, foundWAFConfig, "expected rendered WAF support file")
+	require.NotEmpty(t, wafRuntime.RuleGroups)
+	assert.Equal(t, globalGroup.ID, wafRuntime.RuleGroups[0].ID)
+	assert.True(t, wafRuntime.RuleGroups[0].IsGlobal)
+	require.Len(t, wafRuntime.Bindings, 1)
+	assert.Equal(t, route.ID, wafRuntime.Bindings[0].RouteID)
+	assert.Equal(t, "example.com", wafRuntime.Bindings[0].SiteName)
+	assert.Equal(t, []uint{customGroup.ID}, wafRuntime.Bindings[0].RuleGroupIDs)
+	assert.Contains(t, bundle.RouteConfig, `set $openflare_waf_site "example.com"`)
+}
+
+func TestBuildCurrentConfigBundleEnablesGlobalPoWWithoutExplicitBinding(t *testing.T) {
+	cleanup := setupConfigVersionTestDB(t)
+	defer cleanup()
+	ctx := context.Background()
+
+	route := &model.ProxyRoute{
+		SiteName:  "pow-global.example.com",
+		OriginURL: "http://origin.example.com:8080",
+		Upstreams: `["http://origin.example.com:8080"]`,
+		Enabled:   true,
+	}
+	require.NoError(t, repository.CreateProxyRouteRecord(ctx, route))
+	createSnapshotZoneDomains(t, ctx, route, "pow-global.example.com")
+
+	require.NoError(t, waf.EnsureDefaultRuleGroup(ctx))
+	globalGroup, err := repository.GetGlobalOpenFlareWAFRuleGroup(ctx)
+	require.NoError(t, err)
+	graphJSON, err := json.Marshal(snapshotPoWGraph())
+	require.NoError(t, err)
+	globalGroup.Graph = string(graphJSON)
+	require.NoError(t, db.DB(ctx).Model(globalGroup).Update("graph", globalGroup.Graph).Error)
+
+	bundle, err := buildCurrentConfigBundle(ctx, true)
+	require.NoError(t, err)
+	var wafRuntime openrestyrender.WAFDocument
+	foundWAFConfig := false
+	for _, file := range bundle.SupportFiles {
+		if file.Path != "waf_config.json" {
+			continue
+		}
+		foundWAFConfig = true
+		assert.Contains(t, file.Content, `"rule_group_ids":[]`)
+		assert.NotContains(t, file.Content, `"rule_group_ids":null`)
+		require.NoError(t, json.Unmarshal([]byte(file.Content), &wafRuntime))
+	}
+	require.True(t, foundWAFConfig, "expected rendered WAF support file")
+	require.NotEmpty(t, wafRuntime.RuleGroups)
+	assert.Equal(t, globalGroup.ID, wafRuntime.RuleGroups[0].ID)
+	assert.True(t, wafRuntime.RuleGroups[0].IsGlobal)
+	assert.Equal(t, string(waf.RuleNodePoW), wafRuntime.RuleGroups[0].Graph.Nodes["pow"].Type)
+	require.Len(t, wafRuntime.Bindings, 1)
+	assert.Equal(t, "pow-global.example.com", wafRuntime.Bindings[0].SiteName)
+	assert.Empty(t, wafRuntime.Bindings[0].RuleGroupIDs)
+	require.NotEmpty(t, bundle.WAFSnapshot.RuleGroups)
+	assert.Equal(t, waf.RuleNodePoW, bundle.WAFSnapshot.RuleGroups[0].Graph.Nodes["pow"].Type)
+}

backend/openflare/plugins/server/domain/site/config_version/origin_error_page_snapshot_test.go

@@ -0,0 +1,128 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package config_version
+
+import (
+	"context"
+	"encoding/json"
+	"testing"
+
+	"Wavelet/openflare/plugins/server/kernel/model"
+	"Wavelet/pkg/cache/ram"
+	db "Wavelet/plugins/infra/database"
+
+	"github.com/glebarez/sqlite"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"gorm.io/gorm"
+)
+
+func setupOriginErrorPageSnapshotDB(t *testing.T) func() {
+	t.Helper()
+
+	// repository 读配置会写进程级 RAM 缓存（跨测试存活），换 DB 前后必须
+	// 重置，否则 shuffle 下先跑的用例会污染后跑的用例。
+	ram.ResetForTest()
+
+	sqliteDB, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{
+		DisableForeignKeyConstraintWhenMigrating: true,
+	})
+	require.NoError(t, err)
+	require.NoError(t, sqliteDB.AutoMigrate(&model.SystemConfig{}))
+	db.SetDB(sqliteDB)
+
+	return func() {
+		db.SetDB(nil)
+		ram.ResetForTest()
+	}
+}
+
+func TestBuildOpenRestyConfigSnapshotOriginErrorPageDefaults(t *testing.T) {
+	cleanup := setupOriginErrorPageSnapshotDB(t)
+	defer cleanup()
+
+	snapshot := buildOpenRestyConfigSnapshot(context.Background())
+	assert.True(t, snapshot.OriginErrorPageEnabled)
+	assert.Equal(t, []string{"500-599"}, snapshot.OriginErrorPageStatusCodes)
+	assert.Empty(t, snapshot.OriginErrorPageHTML)
+
+	payload, err := json.Marshal(snapshot)
+	require.NoError(t, err)
+	assert.Contains(t, string(payload), `"origin_error_page_enabled":true`)
+	assert.Contains(t, string(payload), `"origin_error_page_status_codes":["500-599"]`)
+}
+
+func TestBuildOpenRestyConfigSnapshotOriginErrorPageCustom(t *testing.T) {
+	cleanup := setupOriginErrorPageSnapshotDB(t)
+	defer cleanup()
+	ctx := context.Background()
+
+	require.NoError(t, db.DB(ctx).Create(&model.SystemConfig{
+		Key: model.ConfigKeyOriginErrorPageEnabled, Value: "false", Type: "business",
+	}).Error)
+	require.NoError(t, db.DB(ctx).Create(&model.SystemConfig{
+		Key: model.ConfigKeyOriginErrorPageStatusCodes, Value: `["522","500-502"]`, Type: "business",
+	}).Error)
+	require.NoError(t, db.DB(ctx).Create(&model.SystemConfig{
+		Key: model.ConfigKeyOriginErrorPageHTML, Value: "<h1>{{status}}</h1>", Type: "business",
+	}).Error)
+
+	snapshot := buildOpenRestyConfigSnapshot(ctx)
+	assert.False(t, snapshot.OriginErrorPageEnabled)
+	assert.Equal(t, []string{"522", "500-502"}, snapshot.OriginErrorPageStatusCodes)
+	assert.Equal(t, "<h1>{{status}}</h1>", snapshot.OriginErrorPageHTML)
+}
+
+func TestParseOriginErrorPageStatusCodesFallback(t *testing.T) {
+	t.Parallel()
+
+	assert.Equal(t, []string{"500-599"}, parseOriginErrorPageStatusCodes(""))
+	assert.Equal(t, []string{"500-599"}, parseOriginErrorPageStatusCodes("not-json"))
+	assert.Equal(t, []string{"500-599"}, parseOriginErrorPageStatusCodes("[]"))
+	assert.Equal(t, []string{"502"}, parseOriginErrorPageStatusCodes(`["502"]`))
+}
+
+func TestDiffOpenRestyOptionDetailsOriginErrorPage(t *testing.T) {
+	t.Parallel()
+
+	left := openRestyConfigSnapshot{
+		OriginErrorPageEnabled:     true,
+		OriginErrorPageStatusCodes: []string{"500-599"},
+		OriginErrorPageHTML:        "",
+	}
+	right := openRestyConfigSnapshot{
+		OriginErrorPageEnabled:     false,
+		OriginErrorPageStatusCodes: []string{"522"},
+		OriginErrorPageHTML:        "<p>x</p>",
+	}
+	details := diffOpenRestyOptionDetails(left, right)
+	keys := make(map[string]ConfigOptionDiffItem, len(details))
+	for _, item := range details {
+		keys[item.Key] = item
+	}
+	assert.Equal(t, "true", keys["OriginErrorPageEnabled"].PreviousValue)
+	assert.Equal(t, "false", keys["OriginErrorPageEnabled"].CurrentValue)
+	assert.Equal(t, `["500-599"]`, keys["OriginErrorPageStatusCodes"].PreviousValue)
+	assert.Equal(t, `["522"]`, keys["OriginErrorPageStatusCodes"].CurrentValue)
+	assert.Empty(t, keys["OriginErrorPageHTML"].PreviousValue)
+	assert.Equal(t, "<p>x</p>", keys["OriginErrorPageHTML"].CurrentValue)
+}
+
+func TestDiffOpenRestyOptionDetailsSWOfflineDomains(t *testing.T) {
+	t.Parallel()
+
+	left := openRestyConfigSnapshot{
+		SWOfflineDomains: []string{"a.com,b.com"},
+	}
+	right := openRestyConfigSnapshot{
+		SWOfflineDomains: []string{"a.com", "b.com"},
+	}
+	details := diffOpenRestyOptionDetails(left, right)
+	keys := make(map[string]ConfigOptionDiffItem, len(details))
+	for _, item := range details {
+		keys[item.Key] = item
+	}
+	assert.Equal(t, `["a.com,b.com"]`, keys["SWOfflineDomains"].PreviousValue)
+	assert.Equal(t, `["a.com","b.com"]`, keys["SWOfflineDomains"].CurrentValue)
+}

backend/openflare/plugins/server/domain/site/config_version/pages_snapshot.go

@@ -0,0 +1,118 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package config_version
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"path"
+	"strings"
+
+	"Wavelet/openflare/plugins/server/kernel/repository"
+
+	"Wavelet/openflare/plugins/server/kernel/model"
+	"Wavelet/openflare/share/pagesarchive"
+	openrestyrender "Wavelet/openflare/share/render/openresty"
+
+	"gorm.io/gorm"
+)
+
+const defaultPagesSnapshotEntryFile = "index.html"
+const defaultPagesSnapshotFallbackPath = "/index.html"
+
+func buildPagesRouteSnapshot(
+	ctx context.Context,
+	route *model.ProxyRoute,
+) (originURL string, upstreams []string, pagesProjectID *uint, deployment *openrestyrender.PagesDeployment, err error) {
+	if route == nil {
+		return "", nil, nil, nil, errors.New("pages 路由配置无效")
+	}
+	if !repository.HasPagesProjectsTable(ctx) {
+		return "", nil, nil, nil, fmt.Errorf("路由 %s Pages 配置无效: pages 模块不可用", route.SiteName)
+	}
+	if route.PagesProjectID == nil || *route.PagesProjectID == 0 {
+		return "", nil, nil, nil, fmt.Errorf("路由 %s Pages 配置无效: 未绑定 Pages 项目", route.SiteName)
+	}
+	project, err := repository.GetPagesProjectByID(ctx, *route.PagesProjectID)
+	if err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			return "", nil, nil, nil, fmt.Errorf("路由 %s Pages 配置无效: pages 项目不存在", route.SiteName)
+		}
+		return "", nil, nil, nil, err
+	}
+	if !project.Enabled {
+		return "", nil, nil, nil, fmt.Errorf("路由 %s Pages 配置无效: pages 项目未启用", route.SiteName)
+	}
+	if project.ActiveDeploymentID == nil || *project.ActiveDeploymentID == 0 {
+		return "", nil, nil, nil, fmt.Errorf("路由 %s Pages 配置无效: pages 项目没有激活部署", route.SiteName)
+	}
+	activeDeployment, err := repository.GetPagesDeploymentByID(ctx, *project.ActiveDeploymentID)
+	if err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			return "", nil, nil, nil, fmt.Errorf("路由 %s Pages 配置无效: pages 激活部署不存在", route.SiteName)
+		}
+		return "", nil, nil, nil, err
+	}
+	if activeDeployment.ProjectID != project.ID {
+		return "", nil, nil, nil, fmt.Errorf("路由 %s Pages 配置无效: pages 激活部署不匹配", route.SiteName)
+	}
+	if strings.TrimSpace(activeDeployment.Checksum) == "" {
+		return "", nil, nil, nil, fmt.Errorf("路由 %s Pages 配置无效: pages 部署校验和缺失", route.SiteName)
+	}
+
+	pagesProjectID = route.PagesProjectID
+	deployment, err = buildSnapshotPagesDeployment(project, activeDeployment)
+	if err != nil {
+		return "", nil, nil, nil, fmt.Errorf("路由 %s Pages 配置无效: %w", route.SiteName, err)
+	}
+	originURL = fmt.Sprintf("openflare-pages://project/%d", project.ID)
+	return originURL, []string{originURL}, pagesProjectID, deployment, nil
+}
+
+func buildSnapshotPagesDeployment(
+	project *model.PagesProject,
+	activeDeployment *model.PagesDeployment,
+) (*openrestyrender.PagesDeployment, error) {
+	if project == nil || activeDeployment == nil {
+		return nil, errors.New("pages 项目或部署为空")
+	}
+	rootDir, err := pagesarchive.NormalizeLogicalPath(strings.TrimSpace(project.RootDir), true)
+	if err != nil {
+		return nil, fmt.Errorf("pages 根目录不合法: %w", err)
+	}
+	entryFile := strings.TrimSpace(project.EntryFile)
+	if entryFile == "" {
+		entryFile = defaultPagesSnapshotEntryFile
+	}
+	entryFile, err = pagesarchive.NormalizeLogicalPath(entryFile, false)
+	if err != nil {
+		return nil, fmt.Errorf("pages 入口文件不合法: %w", err)
+	}
+	fallbackPath := strings.TrimSpace(project.SPAFallbackPath)
+	if fallbackPath == "" {
+		fallbackPath = defaultPagesSnapshotFallbackPath
+	}
+	localRoot := openrestyrender.PagesProjectLocalRoot(project.ID)
+	if rootDir != "" {
+		localRoot = path.Join(localRoot, rootDir)
+	}
+	return &openrestyrender.PagesDeployment{
+		ProjectID:          project.ID,
+		ProjectSlug:        strings.TrimSpace(project.Slug),
+		DeploymentID:       activeDeployment.ID,
+		DeploymentNumber:   activeDeployment.DeploymentNumber,
+		Checksum:           strings.TrimSpace(activeDeployment.Checksum),
+		EntryFile:          entryFile,
+		SPAFallbackEnabled: project.SPAFallbackEnabled,
+		SPAFallbackPath:    fallbackPath,
+		APIProxyEnabled:    project.APIProxyEnabled,
+		APIProxyPath:       strings.TrimSpace(project.APIProxyPath),
+		APIProxyPass:       strings.TrimSpace(project.APIProxyPass),
+		APIProxyRewrite:    strings.TrimSpace(project.APIProxyRewrite),
+		// Root is project-scoped so Agents can swap active packages without
+		// re-publishing main config (nginx root stays stable).
+		LocalRoot: localRoot,
+	}, nil
+}

backend/openflare/plugins/server/domain/site/config_version/pages_snapshot_test.go

@@ -0,0 +1,105 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package config_version
+
+import (
+	"context"
+	"encoding/json"
+	"testing"
+
+	"Wavelet/openflare/plugins/server/kernel/repository"
+
+	"Wavelet/openflare/plugins/server/kernel/model"
+	openrestyrender "Wavelet/openflare/share/render/openresty"
+	db "Wavelet/plugins/infra/database"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"gorm.io/gorm"
+)
+
+func TestBuildSnapshotRoutesPages(t *testing.T) {
+	cleanup := setupConfigVersionTestDB(t)
+	defer cleanup()
+	ctx := context.Background()
+	conn := requireDB(t, ctx)
+
+	project := &model.PagesProject{
+		Name:               "Speed Test",
+		Slug:               "speedtest",
+		Enabled:            true,
+		SPAFallbackEnabled: true,
+		SPAFallbackPath:    "/index.html",
+		RootDir:            "public/site",
+		EntryFile:          "index.html",
+	}
+	require.NoError(t, conn.Create(project).Error)
+
+	deployment := &model.PagesDeployment{
+		ProjectID:        project.ID,
+		DeploymentNumber: 1,
+		Checksum:         "abc123checksum",
+		Status:           model.PagesDeploymentStatusActive,
+		FileCount:        1,
+		TotalSize:        12,
+	}
+	require.NoError(t, conn.Create(deployment).Error)
+	require.NoError(t, conn.Model(project).Update("active_deployment_id", deployment.ID).Error)
+
+	route := &model.ProxyRoute{
+		SiteName:       "speedtest",
+		OriginURL:      "openflare-pages://project/1",
+		Upstreams:      `["openflare-pages://project/1"]`,
+		Enabled:        true,
+		UpstreamType:   "pages",
+		PagesProjectID: &project.ID,
+	}
+	require.NoError(t, repository.CreateProxyRouteRecord(ctx, route))
+	createSnapshotZoneDomains(t, ctx, route, "speedtest.arctel.net")
+
+	bundle, err := buildCurrentConfigBundle(ctx, true)
+	require.NoError(t, err)
+	require.Len(t, bundle.SnapshotRoutes, 1)
+
+	snapshotRoute := bundle.SnapshotRoutes[0]
+	assert.Equal(t, "pages", snapshotRoute.UpstreamType)
+	assert.Equal(t, "openflare-pages://project/1", snapshotRoute.OriginURL)
+	require.NotNil(t, snapshotRoute.PagesDeployment)
+	assert.Equal(t, deployment.ID, snapshotRoute.PagesDeployment.DeploymentID)
+	assert.Equal(t, deployment.Checksum, snapshotRoute.PagesDeployment.Checksum)
+	assert.Equal(t, "__OPENFLARE_PAGES_DIR__/projects/1/current/public/site", snapshotRoute.PagesDeployment.LocalRoot)
+
+	_, err = renderSnapshotConfig(bundle.SnapshotJSON, nil)
+	require.NoError(t, err)
+
+	var decoded struct {
+		Routes []struct {
+			PagesDeployment *openrestyrender.PagesDeployment `json:"pages_deployment"`
+		} `json:"routes"`
+	}
+	require.NoError(t, json.Unmarshal([]byte(bundle.SnapshotJSON), &decoded))
+	require.NotNil(t, decoded.Routes[0].PagesDeployment)
+}
+
+func TestBuildSnapshotPagesDeploymentRejectsUnsafeStoredPaths(t *testing.T) {
+	deployment := &model.PagesDeployment{ID: 1, ProjectID: 1, Checksum: "checksum"}
+	for _, project := range []*model.PagesProject{
+		{ID: 1, RootDir: "../escape", EntryFile: "index.html"},
+		{ID: 1, RootDir: "public", EntryFile: "/index.html"},
+	} {
+		_, err := buildSnapshotPagesDeployment(project, deployment)
+		require.Error(t, err)
+	}
+}
+
+func requireDB(t *testing.T, ctx context.Context) *gorm.DB {
+	t.Helper()
+	conn := db.DB(ctx)
+	require.NotNil(t, conn)
+	require.NoError(t, conn.AutoMigrate(
+		&model.PagesProject{},
+		&model.PagesDeployment{},
+	))
+	return conn
+}

backend/openflare/plugins/server/domain/site/config_version/proxy_cache_path_test.go

@@ -0,0 +1,19 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package config_version
+
+import (
+	"testing"
+
+	openrestyrender "Wavelet/openflare/share/render/openresty"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestNormalizeProxyCachePathForSnapshot(t *testing.T) {
+	assert.Equal(t, "/var/cache/openresty", normalizeProxyCachePathForSnapshot(false, "/var/cache/openresty"))
+	assert.Equal(t, openrestyrender.ProxyCachePathPlaceholder, normalizeProxyCachePathForSnapshot(true, "/var/cache/openresty"))
+	assert.Equal(t, openrestyrender.ProxyCachePathPlaceholder, normalizeProxyCachePathForSnapshot(true, ""))
+	assert.Equal(t, "/data/var/cache/custom", normalizeProxyCachePathForSnapshot(true, "/data/var/cache/custom"))
+}

backend/openflare/plugins/server/domain/site/config_version/renderer.go

@@ -0,0 +1,53 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package config_version
+
+import (
+	openrestyrender "Wavelet/openflare/share/render/openresty"
+)
+
+// SupportFile is a rendered configuration support artifact.
+type SupportFile struct {
+	Path    string `json:"path"`
+	Content string `json:"content"`
+}
+
+func renderSnapshotConfig(sourceJSON string, certificateFiles []SupportFile) (*openrestyrender.Result, error) {
+	return openrestyrender.RenderJSON(sourceJSON, toOpenRestySupportFiles(certificateFiles))
+}
+
+func toOpenRestySupportFiles(files []SupportFile) []openrestyrender.SupportFile {
+	if len(files) == 0 {
+		return nil
+	}
+	result := make([]openrestyrender.SupportFile, 0, len(files))
+	for _, file := range files {
+		result = append(result, openrestyrender.SupportFile{
+			Path:    file.Path,
+			Content: file.Content,
+		})
+	}
+	return result
+}
+
+func fromOpenRestySupportFiles(files []openrestyrender.SupportFile) []SupportFile {
+	if len(files) == 0 {
+		return nil
+	}
+	result := make([]SupportFile, 0, len(files))
+	for _, file := range files {
+		result = append(result, SupportFile{
+			Path:    file.Path,
+			Content: file.Content,
+		})
+	}
+	return result
+}
+
+func renderPlaceholderConfig(snapshotJSON string) (mainConfig, routeConfig, checksum string) {
+	mainConfig = `{"placeholder":"main_config"}`
+	routeConfig = snapshotJSON
+	checksum = openrestyrender.ChecksumBundle(mainConfig, routeConfig, nil)
+	return mainConfig, routeConfig, checksum
+}

backend/openflare/plugins/server/domain/site/config_version/routers.go

@@ -0,0 +1,199 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package config_version
+
+import (
+	"net/http"
+
+	"Wavelet/openflare/plugins/server/kernel/apiutil"
+	"Wavelet/pkg/response"
+
+	"github.com/gin-gonic/gin"
+)
+
+func handleLogicError(c *gin.Context, err error) bool {
+	if err == nil {
+		return false
+	}
+	return apiutil.AbortNotFoundIfMissing(c, err, "记录不存在")
+}
+
+func versionParam(c *gin.Context) (string, bool) {
+	version := c.Param("id")
+	if version == "" {
+		response.AbortBadRequest(c, "无效的版本号")
+		return "", false
+	}
+	return version, true
+}
+
+// ListConfigVersionsHandler lists config versions.
+// @Summary 获取配置版本列表
+// @Description 返回所有已发布的 OpenResty 配置版本摘要，按创建时间倒序排列，需要管理员权限
+// @Tags openflare-config-version
+// @Produce json
+// @Security SessionCookie
+// @Success 200 {object} response.Any{data=[]model.ConfigVersionSummary} "配置版本列表"
+// @Failure 400 {object} response.Any "参数错误"
+// @Failure 401 {object} response.Any "未登录"
+// @Failure 404 {object} response.Any "无权限或不存在"
+// @Router /api/v1/d/config-versions [get]
+func ListConfigVersionsHandler(c *gin.Context) {
+	versions, err := ListConfigVersions(c.Request.Context())
+	if handleLogicError(c, err) {
+		return
+	}
+	c.JSON(http.StatusOK, response.OK(versions))
+}
+
+// GetConfigVersionHandler returns a config version by id.
+// @Summary 获取配置版本详情
+// @Description 返回指定配置版本的完整快照与渲染内容，需要管理员权限
+// @Tags openflare-config-version
+// @Produce json
+// @Security SessionCookie
+// @Param id path int true "配置版本 ID"
+// @Success 200 {object} response.Any{data=model.ConfigVersion} "配置版本详情"
+// @Failure 400 {object} response.Any "参数错误"
+// @Failure 401 {object} response.Any "未登录"
+// @Failure 404 {object} response.Any "无权限或版本不存在"
+// @Router /api/v1/d/config-versions/{id} [get]
+func GetConfigVersionHandler(c *gin.Context) {
+	versionStr, ok := versionParam(c)
+	if !ok {
+		return
+	}
+	version, err := GetConfigVersionDetail(c.Request.Context(), versionStr)
+	if handleLogicError(c, err) {
+		return
+	}
+	c.JSON(http.StatusOK, response.OK(version))
+}
+
+// GetActiveConfigVersionHandler returns the active config version.
+// @Summary 获取当前活跃配置版本
+// @Description 返回当前正在使用的配置版本，需要管理员权限
+// @Tags openflare-config-version
+// @Produce json
+// @Security SessionCookie
+// @Success 200 {object} response.Any{data=model.ConfigVersion} "活跃配置版本"
+// @Failure 401 {object} response.Any "未登录"
+// @Failure 404 {object} response.Any "无权限、不存在或无活跃版本"
+// @Router /api/v1/d/config-versions/active [get]
+func GetActiveConfigVersionHandler(c *gin.Context) {
+	version, err := GetActiveConfigVersion(c.Request.Context())
+	if apiutil.AbortNotFoundIfMissing(c, err, errNoActiveVersion) {
+		return
+	}
+	c.JSON(http.StatusOK, response.OK(version))
+}
+
+// PreviewConfigVersionHandler previews the current draft configuration.
+// @Summary 预览当前草稿配置
+// @Description 渲染并返回当前草稿配置的预览结果，需要管理员权限
+// @Tags openflare-config-version
+// @Produce json
+// @Security SessionCookie
+// @Success 200 {object} response.Any{data=config_version.ConfigPreviewResult} "配置预览"
+// @Failure 400 {object} response.Any "参数错误"
+// @Failure 401 {object} response.Any "未登录"
+// @Failure 404 {object} response.Any "无权限或不存在"
+// @Router /api/v1/d/config-versions/preview [get]
+func PreviewConfigVersionHandler(c *gin.Context) {
+	preview, err := PreviewConfigVersion(c.Request.Context())
+	if handleLogicError(c, err) {
+		return
+	}
+	c.JSON(http.StatusOK, response.OK(preview))
+}
+
+// DiffConfigVersionHandler diffs the current draft against the active version.
+// @Summary 对比草稿与活跃配置
+// @Description 对比当前草稿配置与活跃版本之间的差异，需要管理员权限
+// @Tags openflare-config-version
+// @Produce json
+// @Security SessionCookie
+// @Success 200 {object} response.Any{data=config_version.ConfigDiffResult} "配置差异"
+// @Failure 400 {object} response.Any "参数错误"
+// @Failure 401 {object} response.Any "未登录"
+// @Failure 404 {object} response.Any "无权限或不存在"
+// @Router /api/v1/d/config-versions/diff [get]
+func DiffConfigVersionHandler(c *gin.Context) {
+	diff, err := DiffConfigVersion(c.Request.Context())
+	if handleLogicError(c, err) {
+		return
+	}
+	c.JSON(http.StatusOK, response.OK(diff))
+}
+
+// PublishConfigVersionHandler publishes a new config version.
+// @Summary 发布配置版本
+// @Description 将当前草稿配置发布为新版本，需要管理员权限
+// @Tags openflare-config-version
+// @Produce json
+// @Security SessionCookie
+// @Param force query bool false "是否强制发布"
+// @Success 200 {object} response.Any{data=model.ConfigVersion} "发布成功"
+// @Failure 400 {object} response.Any "参数错误"
+// @Failure 401 {object} response.Any "未登录"
+// @Failure 404 {object} response.Any "无权限或不存在"
+// @Router /api/v1/d/config-versions/publish [post]
+func PublishConfigVersionHandler(c *gin.Context) {
+	username := c.GetString("username")
+	force := c.Query("force") == "true"
+	version, err := PublishConfigVersion(c.Request.Context(), username, force)
+	if handleLogicError(c, err) {
+		return
+	}
+	c.JSON(http.StatusOK, response.OK(version))
+}
+
+// ActivateConfigVersionHandler activates an existing config version.
+// @Summary 激活配置版本
+// @Description 将指定历史版本设为当前活跃配置，需要管理员权限
+// @Tags openflare-config-version
+// @Produce json
+// @Security SessionCookie
+// @Param id path int true "配置版本 ID"
+// @Success 200 {object} response.Any{data=model.ConfigVersion} "激活成功"
+// @Failure 400 {object} response.Any "参数错误"
+// @Failure 401 {object} response.Any "未登录"
+// @Failure 404 {object} response.Any "无权限或版本不存在"
+// @Router /api/v1/d/config-versions/{id}/activate [post]
+func ActivateConfigVersionHandler(c *gin.Context) {
+	versionStr, ok := versionParam(c)
+	if !ok {
+		return
+	}
+	version, err := ActivateConfigVersion(c.Request.Context(), versionStr)
+	if handleLogicError(c, err) {
+		return
+	}
+	c.JSON(http.StatusOK, response.OK(version))
+}
+
+// CleanupConfigVersionsHandler removes old inactive config versions.
+// @Summary 清理历史配置版本
+// @Description 删除超出保留数量的非活跃配置版本，需要管理员权限
+// @Tags openflare-config-version
+// @Accept json
+// @Produce json
+// @Security SessionCookie
+// @Param body body config_version.CleanupInput true "清理参数"
+// @Success 200 {object} response.Any{data=config_version.CleanupResult} "清理结果"
+// @Failure 400 {object} response.Any "参数错误"
+// @Failure 401 {object} response.Any "未登录"
+// @Failure 404 {object} response.Any "无权限或不存在"
+// @Router /api/v1/d/config-versions/cleanup [post]
+func CleanupConfigVersionsHandler(c *gin.Context) {
+	var input CleanupInput
+	if !apiutil.BindJSON(c, &input) {
+		return
+	}
+	result, err := CleanupConfigVersions(c.Request.Context(), input.KeepCount)
+	if handleLogicError(c, err) {
+		return
+	}
+	c.JSON(http.StatusOK, response.OK(result))
+}

backend/openflare/plugins/server/domain/site/config_version/snapshot.go

@@ -0,0 +1,652 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package config_version
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"slices"
+	"sort"
+	"strconv"
+	"strings"
+
+	oftls "Wavelet/openflare/plugins/server/domain/tls"
+	"Wavelet/openflare/plugins/server/domain/waf"
+	"Wavelet/openflare/plugins/server/kernel/model"
+	"Wavelet/openflare/plugins/server/kernel/repository"
+	"Wavelet/openflare/share/protocol"
+	openrestyrender "Wavelet/openflare/share/render/openresty"
+
+	"gorm.io/gorm"
+)
+
+const (
+	supportFilesPerCertificate  = 2
+	wafIPGroupChecksumHexLength = 64
+
+	// OpenResty 默认配置值
+	defaultOpenRestyReturnStatus     = 421
+	defaultOpenRestyWorkerConns      = 4096
+	defaultOpenRestyRlimitNofile     = 65535
+	defaultOpenRestyKeepaliveTimeout = 20
+	defaultOpenRestyKeepaliveReqs    = 1000
+	defaultOpenRestyHeaderTimeout    = 15
+	defaultOpenRestyBodyTimeout      = 15
+	defaultOpenRestySendTimeout      = 30
+	defaultOpenRestyConnectTimeout   = 3
+	defaultOpenRestyProxyTimeout     = 60
+	defaultOpenRestyGzipMinLen       = 1024
+	defaultOpenRestyGzipLevel        = 5
+)
+
+type snapshotRoute struct {
+	ID                 uint                             `json:"id,omitempty"`
+	SiteName           string                           `json:"site_name,omitempty"`
+	Domains            []string                         `json:"domains,omitempty"`
+	OriginURL          string                           `json:"origin_url"`
+	OriginHost         string                           `json:"origin_host,omitempty"`
+	Upstreams          []string                         `json:"upstreams,omitempty"`
+	Enabled            bool                             `json:"enabled"`
+	EnableHTTPS        bool                             `json:"enable_https"`
+	DomainCertIDs      []uint                           `json:"domain_cert_ids,omitempty"`
+	RedirectHTTP       bool                             `json:"redirect_http"`
+	LimitConnPerServer int                              `json:"limit_conn_per_server,omitempty"`
+	LimitConnPerIP     int                              `json:"limit_conn_per_ip,omitempty"`
+	LimitRate          string                           `json:"limit_rate,omitempty"`
+	LimitReqPerIP      string                           `json:"limit_req_per_ip,omitempty"`
+	CacheEnabled       bool                             `json:"cache_enabled"`
+	CachePolicy        string                           `json:"cache_policy,omitempty"`
+	CacheRules         []string                         `json:"cache_rules,omitempty"`
+	CustomHeaders      []customHeaderInput              `json:"custom_headers,omitempty"`
+	BasicAuthEnabled   bool                             `json:"basic_auth_enabled,omitempty"`
+	BasicAuthUsername  string                           `json:"basic_auth_username,omitempty"`
+	BasicAuthPassword  string                           `json:"basic_auth_password,omitempty"`
+	UpstreamType       string                           `json:"upstream_type,omitempty"`
+	TunnelNodeID       *uint                            `json:"tunnel_node_id,omitempty"`
+	TunnelTargetAddr   string                           `json:"tunnel_target_addr,omitempty"`
+	TunnelTargetProto  string                           `json:"tunnel_target_protocol,omitempty"`
+	PagesProjectID     *uint                            `json:"pages_project_id,omitempty"`
+	PagesDeployment    *openrestyrender.PagesDeployment `json:"pages_deployment,omitempty"`
+}
+
+type snapshotWAFRuleGroup struct {
+	ID       uint                 `json:"id"`
+	Name     string               `json:"name"`
+	Enabled  bool                 `json:"enabled"`
+	IsGlobal bool                 `json:"is_global"`
+	Graph    waf.RuntimeRuleGraph `json:"graph"`
+}
+
+type snapshotWAFIPGroup struct {
+	ID      uint     `json:"id"`
+	Name    string   `json:"name"`
+	Type    string   `json:"type"`
+	Enabled bool     `json:"enabled"`
+	IPList  []string `json:"ip_list,omitempty"`
+}
+
+type snapshotWAFBinding struct {
+	RouteID      uint   `json:"route_id"`
+	SiteName     string `json:"site_name"`
+	RuleGroupIDs []uint `json:"rule_group_ids"`
+}
+
+type snapshotWAFDocument struct {
+	RuleGroups []snapshotWAFRuleGroup `json:"rule_groups"`
+	IPGroups   []snapshotWAFIPGroup   `json:"ip_groups,omitempty"`
+	Bindings   []snapshotWAFBinding   `json:"bindings"`
+}
+
+type openRestyConfigSnapshot struct {
+	DefaultServerReturnStatus  int      `json:"default_server_return_status"`
+	WorkerProcesses            string   `json:"worker_processes"`
+	WorkerConnections          int      `json:"worker_connections"`
+	WorkerRlimitNofile         int      `json:"worker_rlimit_nofile"`
+	EventsUse                  string   `json:"events_use,omitempty"`
+	EventsMultiAcceptEnabled   bool     `json:"events_multi_accept_enabled"`
+	KeepaliveTimeout           int      `json:"keepalive_timeout"`
+	KeepaliveRequests          int      `json:"keepalive_requests"`
+	ClientHeaderTimeout        int      `json:"client_header_timeout"`
+	ClientBodyTimeout          int      `json:"client_body_timeout"`
+	ClientMaxBodySize          string   `json:"client_max_body_size"`
+	LargeClientHeaderBuffers   string   `json:"large_client_header_buffers"`
+	SendTimeout                int      `json:"send_timeout"`
+	ProxyConnectTimeout        int      `json:"proxy_connect_timeout"`
+	ProxySendTimeout           int      `json:"proxy_send_timeout"`
+	ProxyReadTimeout           int      `json:"proxy_read_timeout"`
+	WebsocketEnabled           bool     `json:"websocket_enabled"`
+	HTTP3Enabled               bool     `json:"http3_enabled"`
+	ProxyRequestBuffering      bool     `json:"proxy_request_buffering"`
+	ProxyBufferingEnabled      bool     `json:"proxy_buffering_enabled"`
+	ProxyBuffers               string   `json:"proxy_buffers"`
+	ProxyBufferSize            string   `json:"proxy_buffer_size"`
+	ProxyBusyBuffersSize       string   `json:"proxy_busy_buffers_size"`
+	GzipEnabled                bool     `json:"gzip_enabled"`
+	GzipMinLength              int      `json:"gzip_min_length"`
+	GzipCompLevel              int      `json:"gzip_comp_level"`
+	Resolvers                  string   `json:"resolvers,omitempty"`
+	CacheEnabled               bool     `json:"cache_enabled"`
+	CachePath                  string   `json:"cache_path,omitempty"`
+	CacheLevels                string   `json:"cache_levels"`
+	CacheInactive              string   `json:"cache_inactive"`
+	CacheMaxSize               string   `json:"cache_max_size"`
+	CacheKeyTemplate           string   `json:"cache_key_template"`
+	CacheLockEnabled           bool     `json:"cache_lock_enabled"`
+	CacheLockTimeout           string   `json:"cache_lock_timeout"`
+	CacheUseStale              string   `json:"cache_use_stale"`
+	MainConfigTemplate         string   `json:"main_config_template,omitempty"`
+	DefaultLimitConnPerServer  int      `json:"default_limit_conn_per_server,omitempty"`
+	DefaultLimitConnPerIP      int      `json:"default_limit_conn_per_ip,omitempty"`
+	DefaultLimitRate           string   `json:"default_limit_rate,omitempty"`
+	DefaultLimitReqPerIP       string   `json:"default_limit_req_per_ip,omitempty"`
+	OriginErrorPageEnabled     bool     `json:"origin_error_page_enabled"`
+	OriginErrorPageStatusCodes []string `json:"origin_error_page_status_codes,omitempty"`
+	OriginErrorPageHTML        string   `json:"origin_error_page_html,omitempty"`
+	OriginErrorPageGetOnly     bool     `json:"origin_error_page_get_only,omitempty"`
+	SWOfflineEnabled           bool     `json:"sw_offline_enabled,omitempty"`
+	SWOfflineHTML              string   `json:"sw_offline_html,omitempty"`
+	SWOfflineDomains           []string `json:"sw_offline_domains,omitempty"`
+}
+
+type snapshotDocument struct {
+	Routes          []snapshotRoute         `json:"routes"`
+	OpenRestyConfig openRestyConfigSnapshot `json:"openresty_config"`
+	WAF             snapshotWAFDocument     `json:"waf"`
+}
+
+type configBundle struct {
+	Routes            []*model.ProxyRoute
+	SnapshotRoutes    []snapshotRoute
+	WAFSnapshot       snapshotWAFDocument
+	OpenRestyConfig   openRestyConfigSnapshot
+	SnapshotJSON      string
+	MainConfig        string
+	RouteConfig       string
+	SupportFiles      []SupportFile
+	Checksum          string
+	ChangedOptionKeys []string
+}
+
+func buildCurrentConfigBundle(ctx context.Context, requireRoutes bool) (*configBundle, error) {
+	routes, err := repository.ListEnabledProxyRoutes(ctx)
+	if err != nil {
+		return nil, err
+	}
+	if requireRoutes && len(routes) == 0 {
+		return nil, errors.New(errNoEnabledRoutes)
+	}
+	snapshotRoutes, err := buildSnapshotRoutes(ctx, routes)
+	if err != nil {
+		return nil, err
+	}
+	wafSnapshot, err := buildSnapshotWAFDocument(ctx, routes)
+	if err != nil {
+		return nil, err
+	}
+	openRestyConfig := buildOpenRestyConfigSnapshot(ctx)
+	snapshotDoc := snapshotDocument{
+		Routes:          snapshotRoutes,
+		OpenRestyConfig: openRestyConfig,
+		WAF:             wafSnapshot,
+	}
+	snapshotJSON, err := json.Marshal(snapshotDoc)
+	if err != nil {
+		return nil, err
+	}
+	certificateFiles, err := buildCertificateSupportFiles(ctx, snapshotRoutes)
+	if err != nil {
+		return nil, err
+	}
+
+	var mainConfig, routeConfig, checksum string
+	supportFiles := []SupportFile(nil)
+
+	rendered, renderErr := renderSnapshotConfig(string(snapshotJSON), certificateFiles)
+	if renderErr == nil {
+		mainConfig = rendered.MainConfig
+		routeConfig = rendered.RouteConfig
+		checksum = rendered.Checksum
+		supportFiles = fromOpenRestySupportFiles(rendered.SupportFiles)
+	} else {
+		mainConfig, routeConfig, checksum = renderPlaceholderConfig(string(snapshotJSON))
+	}
+
+	return &configBundle{
+		Routes:            routes,
+		SnapshotRoutes:    snapshotRoutes,
+		WAFSnapshot:       wafSnapshot,
+		OpenRestyConfig:   openRestyConfig,
+		SnapshotJSON:      string(snapshotJSON),
+		MainConfig:        mainConfig,
+		RouteConfig:       routeConfig,
+		SupportFiles:      supportFiles,
+		Checksum:          checksum,
+		ChangedOptionKeys: openRestyOptionKeys(),
+	}, nil
+}
+
+func buildSnapshotRoutes(ctx context.Context, routes []*model.ProxyRoute) ([]snapshotRoute, error) {
+	items := make([]snapshotRoute, 0, len(routes))
+	for _, route := range routes {
+		zoneDomains, err := repository.ListZoneDomainsByRouteID(ctx, route.ID)
+		if err != nil {
+			return nil, err
+		}
+		if len(zoneDomains) == 0 {
+			return nil, fmt.Errorf("route %s has no zone domains", route.SiteName)
+		}
+		domains := make([]string, 0, len(zoneDomains))
+		domainCertIDs := make([]uint, 0, len(zoneDomains))
+		for _, zoneDomain := range zoneDomains {
+			domains = append(domains, zoneDomain.Domain)
+			if zoneDomain.CertID == nil {
+				domainCertIDs = append(domainCertIDs, 0)
+				continue
+			}
+			domainCertIDs = append(domainCertIDs, *zoneDomain.CertID)
+		}
+		customHeaders, err := decodeStoredCustomHeaders(route.CustomHeaders)
+		if err != nil {
+			return nil, fmt.Errorf("路由 %s 自定义请求头无效", route.SiteName)
+		}
+		upstreamType := normalizeUpstreamType(route.UpstreamType)
+		originURL := route.OriginURL
+		upstreams, err := decodeStoredUpstreams(route.Upstreams, route.OriginURL)
+		if err != nil {
+			return nil, fmt.Errorf("路由 %s 上游配置无效", route.SiteName)
+		}
+		var tunnelNodeID *uint
+		var tunnelTargetAddr string
+		var tunnelTargetProtocol string
+		var pagesProjectID *uint
+		var pagesDeployment *openrestyrender.PagesDeployment
+		switch upstreamType {
+		case "tunnel":
+			originURL = resolveTunnelOpenRestyUpstreamURL(ctx)
+			upstreams = []string{originURL}
+			tunnelNodeID = route.TunnelNodeID
+			tunnelTargetAddr = strings.TrimSpace(route.TunnelTargetAddr)
+			tunnelTargetProtocol = normalizeTunnelTargetProtocol(route.TunnelTargetProtocol)
+		case "pages":
+			originURL, upstreams, pagesProjectID, pagesDeployment, err = buildPagesRouteSnapshot(ctx, route)
+			if err != nil {
+				return nil, err
+			}
+		}
+		cacheRules, err := decodeStoredCacheRules(route.CacheRules)
+		if err != nil {
+			return nil, fmt.Errorf("路由 %s 缓存规则无效", route.SiteName)
+		}
+		items = append(items, snapshotRoute{
+			ID:                 route.ID,
+			SiteName:           route.SiteName,
+			Domains:            domains,
+			OriginURL:          originURL,
+			OriginHost:         route.OriginHost,
+			Upstreams:          upstreams,
+			Enabled:            route.Enabled,
+			EnableHTTPS:        route.EnableHTTPS,
+			DomainCertIDs:      domainCertIDs,
+			RedirectHTTP:       route.RedirectHTTP,
+			LimitConnPerServer: route.LimitConnPerServer,
+			LimitConnPerIP:     route.LimitConnPerIP,
+			LimitRate:          route.LimitRate,
+			LimitReqPerIP:      route.LimitReqPerIP,
+			CacheEnabled:       route.CacheEnabled,
+			CachePolicy:        route.CachePolicy,
+			CacheRules:         cacheRules,
+			CustomHeaders:      customHeaders,
+			BasicAuthEnabled:   route.BasicAuthEnabled,
+			BasicAuthUsername:  route.BasicAuthUsername,
+			BasicAuthPassword:  route.BasicAuthPassword,
+			UpstreamType:       upstreamType,
+			TunnelNodeID:       tunnelNodeID,
+			TunnelTargetAddr:   tunnelTargetAddr,
+			TunnelTargetProto:  tunnelTargetProtocol,
+			PagesProjectID:     pagesProjectID,
+			PagesDeployment:    pagesDeployment,
+		})
+	}
+	return items, nil
+}
+
+func buildSnapshotWAFDocument(ctx context.Context, routes []*model.ProxyRoute) (snapshotWAFDocument, error) {
+	if err := waf.EnsureDefaultRuleGroup(ctx); err != nil {
+		return snapshotWAFDocument{}, err
+	}
+	groups, err := repository.ListOpenFlareWAFRuleGroups(ctx)
+	if err != nil {
+		return snapshotWAFDocument{}, err
+	}
+	ruleGroups := make([]snapshotWAFRuleGroup, 0, len(groups))
+	referencedIPGroupIDs := make(map[uint]struct{})
+	enabledRuleIDs := make(map[uint]struct{})
+	for _, group := range groups {
+		if !group.Enabled {
+			continue
+		}
+		var editorGraph waf.RuleGraph
+		if err = json.Unmarshal([]byte(group.Graph), &editorGraph); err != nil {
+			return snapshotWAFDocument{}, fmt.Errorf("WAF 规则 %s 的图数据无效: %w", group.Name, err)
+		}
+		if err = waf.ValidateRuleGraph(ctx, editorGraph, snapshotWAFIPGroupExists); err != nil {
+			return snapshotWAFDocument{}, fmt.Errorf("WAF 规则 %s 的图无效: %w", group.Name, err)
+		}
+		runtimeGraph, compileErr := waf.CompileRuleGraph(editorGraph)
+		if compileErr != nil {
+			return snapshotWAFDocument{}, fmt.Errorf("WAF 规则 %s 编译失败: %w", group.Name, compileErr)
+		}
+		ruleGroups = append(ruleGroups, snapshotWAFRuleGroup{
+			ID: group.ID, Name: group.Name, Enabled: group.Enabled, IsGlobal: group.IsGlobal, Graph: runtimeGraph,
+		})
+		enabledRuleIDs[group.ID] = struct{}{}
+		for _, id := range waf.ReferencedIPGroupIDs(editorGraph) {
+			referencedIPGroupIDs[id] = struct{}{}
+		}
+	}
+	ipGroups, err := buildSnapshotWAFIPGroups(ctx, referencedIPGroupIDs)
+	if err != nil {
+		return snapshotWAFDocument{}, err
+	}
+	enabledRouteSiteNames := make(map[uint]string, len(routes))
+	for _, route := range routes {
+		if route == nil {
+			continue
+		}
+		domains, domainErr := repository.ListZoneDomainsByRouteID(ctx, route.ID)
+		if domainErr != nil {
+			return snapshotWAFDocument{}, domainErr
+		}
+		if len(domains) == 0 {
+			return snapshotWAFDocument{}, fmt.Errorf("route %s has no zone domains", route.SiteName)
+		}
+		enabledRouteSiteNames[route.ID] = route.SiteName
+	}
+	rawBindings, err := repository.ListOpenFlareWAFRuleGroupBindings(ctx)
+	if err != nil {
+		return snapshotWAFDocument{}, err
+	}
+	groupIDsByRoute := make(map[uint][]uint, len(rawBindings))
+	for _, binding := range rawBindings {
+		if _, ok := enabledRouteSiteNames[binding.ProxyRouteID]; !ok {
+			continue
+		}
+		if _, enabled := enabledRuleIDs[binding.RuleGroupID]; enabled {
+			groupIDsByRoute[binding.ProxyRouteID] = append(groupIDsByRoute[binding.ProxyRouteID], binding.RuleGroupID)
+		}
+	}
+	bindings := make([]snapshotWAFBinding, 0, len(enabledRouteSiteNames))
+	for routeID, siteName := range enabledRouteSiteNames {
+		bindings = append(bindings, snapshotWAFBinding{
+			RouteID:      routeID,
+			SiteName:     siteName,
+			RuleGroupIDs: nonNilUintSlice(groupIDsByRoute[routeID]),
+		})
+	}
+	sort.Slice(bindings, func(i, j int) bool {
+		if bindings[i].SiteName == bindings[j].SiteName {
+			return bindings[i].RouteID < bindings[j].RouteID
+		}
+		return bindings[i].SiteName < bindings[j].SiteName
+	})
+	return snapshotWAFDocument{RuleGroups: ruleGroups, IPGroups: ipGroups, Bindings: bindings}, nil
+}
+
+func nonNilUintSlice(values []uint) []uint {
+	if values == nil {
+		return make([]uint, 0)
+	}
+	return values
+}
+
+func validateSnapshotWAFIPGroupSize(groups []snapshotWAFIPGroup) error {
+	runtimeGroups := make(map[string]protocol.WAFIPGroup, len(groups))
+	for _, group := range groups {
+		ipList := group.IPList
+		if !group.Enabled {
+			ipList = []string{}
+		}
+		runtimeGroups[strconv.FormatUint(uint64(group.ID), 10)] = protocol.WAFIPGroup{
+			ID:       group.ID,
+			Name:     group.Name,
+			Type:     group.Type,
+			Enabled:  group.Enabled,
+			IPList:   ipList,
+			Checksum: strings.Repeat("0", wafIPGroupChecksumHexLength),
+		}
+	}
+	return protocol.ValidateWAFIPGroupSnapshotSize(runtimeGroups)
+}
+
+func buildSnapshotWAFIPGroups(ctx context.Context, idSet map[uint]struct{}) ([]snapshotWAFIPGroup, error) {
+	if len(idSet) == 0 {
+		return []snapshotWAFIPGroup{}, nil
+	}
+	ids := make([]uint, 0, len(idSet))
+	for id := range idSet {
+		ids = append(ids, id)
+	}
+	slices.Sort(ids)
+	groups, err := listWAFIPGroupsByIDs(ctx, ids)
+	if err != nil {
+		return nil, err
+	}
+	groupByID := make(map[uint]*model.OpenFlareWAFIPGroup, len(groups))
+	for _, group := range groups {
+		groupByID[group.ID] = group
+	}
+	snapshots := make([]snapshotWAFIPGroup, 0, len(ids))
+	for _, id := range ids {
+		group := groupByID[id]
+		if group == nil {
+			return nil, fmt.Errorf("IP 组 %d 不存在", id)
+		}
+		ipList, decodeErr := decodeIPList(group.IPList)
+		if decodeErr != nil {
+			return nil, decodeErr
+		}
+		snapshots = append(snapshots, snapshotWAFIPGroup{
+			ID:      group.ID,
+			Name:    group.Name,
+			Type:    group.Type,
+			Enabled: group.Enabled,
+			IPList:  ipList,
+		})
+	}
+	if err = validateSnapshotWAFIPGroupSize(snapshots); err != nil {
+		return nil, err
+	}
+	return snapshots, nil
+}
+
+func snapshotWAFIPGroupExists(ctx context.Context, id uint) (bool, error) {
+	group, err := repository.GetOpenFlareWAFIPGroupByID(ctx, id)
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		return false, nil
+	}
+	return group != nil, err
+}
+
+func decodeIPList(raw string) ([]string, error) {
+	text := strings.TrimSpace(raw)
+	if text == "" {
+		return []string{}, nil
+	}
+	var items []string
+	if err := json.Unmarshal([]byte(text), &items); err != nil {
+		return nil, errors.New("ip_list payload is invalid")
+	}
+	return items, nil
+}
+
+func buildOpenRestyConfigSnapshot(ctx context.Context) openRestyConfigSnapshot {
+	// 读取所有 OpenResty 配置，使用默认值作为降级
+	getIntConfig := func(key string, defaultVal int) int {
+		val, err := repository.GetIntByKey(ctx, key)
+		if err != nil || val <= 0 {
+			return defaultVal
+		}
+		return val
+	}
+
+	// 0 为合法关闭值，不能与 getIntConfig 的 val<=0 语义混用
+	getNonNegIntConfig := func(key string, defaultVal int) int {
+		val, err := repository.GetIntByKey(ctx, key)
+		if err != nil || val < 0 {
+			return defaultVal
+		}
+		return val
+	}
+
+	getBoolConfig := func(key string, defaultVal bool) bool {
+		val, err := repository.GetBoolByKey(ctx, key)
+		if err != nil {
+			return defaultVal
+		}
+		return val
+	}
+
+	getStringConfig := func(key string, defaultVal string) string {
+		config, err := repository.GetSystemConfigByKey(ctx, key)
+		if err != nil {
+			return defaultVal
+		}
+		return config.Value
+	}
+
+	getStringSliceConfig := func(key string, defaultVal []string) []string {
+		config, err := repository.GetSystemConfigByKey(ctx, key)
+		if err != nil {
+			return defaultVal
+		}
+		var values []string
+		if err := json.Unmarshal([]byte(config.Value), &values); err != nil {
+			return defaultVal
+		}
+		return values
+	}
+
+	snapshot := openRestyConfigSnapshot{
+		DefaultServerReturnStatus:  getIntConfig(model.ConfigKeyOpenRestyDefaultServerReturnStatus, defaultOpenRestyReturnStatus),
+		WorkerProcesses:            getStringConfig(model.ConfigKeyOpenRestyWorkerProcesses, "auto"),
+		WorkerConnections:          getIntConfig(model.ConfigKeyOpenRestyWorkerConnections, defaultOpenRestyWorkerConns),
+		WorkerRlimitNofile:         getIntConfig(model.ConfigKeyOpenRestyWorkerRlimitNofile, defaultOpenRestyRlimitNofile),
+		EventsUse:                  getStringConfig(model.ConfigKeyOpenRestyEventsUse, "epoll"),
+		EventsMultiAcceptEnabled:   getBoolConfig(model.ConfigKeyOpenRestyEventsMultiAcceptEnabled, true),
+		KeepaliveTimeout:           getIntConfig(model.ConfigKeyOpenRestyKeepaliveTimeout, defaultOpenRestyKeepaliveTimeout),
+		KeepaliveRequests:          getIntConfig(model.ConfigKeyOpenRestyKeepaliveRequests, defaultOpenRestyKeepaliveReqs),
+		ClientHeaderTimeout:        getIntConfig(model.ConfigKeyOpenRestyClientHeaderTimeout, defaultOpenRestyHeaderTimeout),
+		ClientBodyTimeout:          getIntConfig(model.ConfigKeyOpenRestyClientBodyTimeout, defaultOpenRestyBodyTimeout),
+		ClientMaxBodySize:          getStringConfig(model.ConfigKeyOpenRestyClientMaxBodySize, "64m"),
+		LargeClientHeaderBuffers:   getStringConfig(model.ConfigKeyOpenRestyLargeClientHeaderBuffers, "4 16k"),
+		SendTimeout:                getIntConfig(model.ConfigKeyOpenRestySendTimeout, defaultOpenRestySendTimeout),
+		ProxyConnectTimeout:        getIntConfig(model.ConfigKeyOpenRestyProxyConnectTimeout, defaultOpenRestyConnectTimeout),
+		ProxySendTimeout:           getIntConfig(model.ConfigKeyOpenRestyProxySendTimeout, defaultOpenRestyProxyTimeout),
+		ProxyReadTimeout:           getIntConfig(model.ConfigKeyOpenRestyProxyReadTimeout, defaultOpenRestyProxyTimeout),
+		WebsocketEnabled:           getBoolConfig(model.ConfigKeyOpenRestyWebsocketEnabled, true),
+		HTTP3Enabled:               getBoolConfig(model.ConfigKeyOpenRestyHTTP3Enabled, true),
+		ProxyRequestBuffering:      getBoolConfig(model.ConfigKeyOpenRestyProxyRequestBufferingEnabled, false),
+		ProxyBufferingEnabled:      getBoolConfig(model.ConfigKeyOpenRestyProxyBufferingEnabled, true),
+		ProxyBuffers:               getStringConfig(model.ConfigKeyOpenRestyProxyBuffers, "16 16k"),
+		ProxyBufferSize:            getStringConfig(model.ConfigKeyOpenRestyProxyBufferSize, "8k"),
+		ProxyBusyBuffersSize:       getStringConfig(model.ConfigKeyOpenRestyProxyBusyBuffersSize, "64k"),
+		GzipEnabled:                getBoolConfig(model.ConfigKeyOpenRestyGzipEnabled, true),
+		GzipMinLength:              getIntConfig(model.ConfigKeyOpenRestyGzipMinLength, defaultOpenRestyGzipMinLen),
+		GzipCompLevel:              getIntConfig(model.ConfigKeyOpenRestyGzipCompLevel, defaultOpenRestyGzipLevel),
+		Resolvers:                  getStringConfig(model.ConfigKeyOpenRestyResolvers, ""),
+		CacheEnabled:               getBoolConfig(model.ConfigKeyOpenRestyCacheEnabled, false),
+		CachePath:                  getStringConfig(model.ConfigKeyOpenRestyCachePath, ""),
+		CacheLevels:                getStringConfig(model.ConfigKeyOpenRestyCacheLevels, "1:2"),
+		CacheInactive:              getStringConfig(model.ConfigKeyOpenRestyCacheInactive, "30m"),
+		CacheMaxSize:               getStringConfig(model.ConfigKeyOpenRestyCacheMaxSize, "1g"),
+		CacheKeyTemplate:           getStringConfig(model.ConfigKeyOpenRestyCacheKeyTemplate, "$scheme$host$request_uri"),
+		CacheLockEnabled:           getBoolConfig(model.ConfigKeyOpenRestyCacheLockEnabled, true),
+		CacheLockTimeout:           getStringConfig(model.ConfigKeyOpenRestyCacheLockTimeout, "5s"),
+		CacheUseStale:              getStringConfig(model.ConfigKeyOpenRestyCacheUseStale, "error timeout updating http_500 http_502 http_503 http_504"),
+		MainConfigTemplate:         getStringConfig(model.ConfigKeyOpenRestyMainConfigTemplate, model.DefaultOpenRestyMainConfigTemplate),
+		DefaultLimitConnPerServer:  getNonNegIntConfig(model.ConfigKeyOpenRestyDefaultLimitConnPerServer, 0),
+		DefaultLimitConnPerIP:      getNonNegIntConfig(model.ConfigKeyOpenRestyDefaultLimitConnPerIP, 0),
+		DefaultLimitRate:           strings.ToLower(strings.TrimSpace(getStringConfig(model.ConfigKeyOpenRestyDefaultLimitRate, ""))),
+		DefaultLimitReqPerIP:       strings.ToLower(strings.TrimSpace(getStringConfig(model.ConfigKeyOpenRestyDefaultLimitReqPerIP, ""))),
+		OriginErrorPageEnabled:     getBoolConfig(model.ConfigKeyOriginErrorPageEnabled, true),
+		OriginErrorPageStatusCodes: parseOriginErrorPageStatusCodes(getStringConfig(model.ConfigKeyOriginErrorPageStatusCodes, `["500-599"]`)),
+		OriginErrorPageHTML:        getStringConfig(model.ConfigKeyOriginErrorPageHTML, ""),
+		OriginErrorPageGetOnly:     getBoolConfig(model.ConfigKeyOriginErrorPageGetOnly, false),
+		SWOfflineEnabled:           getBoolConfig(model.ConfigKeySWOfflineEnabled, false),
+		SWOfflineHTML:              getStringConfig(model.ConfigKeySWOfflineHTML, ""),
+		SWOfflineDomains:           getStringSliceConfig(model.ConfigKeySWOfflineDomains, nil),
+	}
+	if snapshot.DefaultLimitRate == "0" {
+		snapshot.DefaultLimitRate = ""
+	}
+	if snapshot.DefaultLimitReqPerIP == "0" {
+		snapshot.DefaultLimitReqPerIP = ""
+	}
+	snapshot.CachePath = normalizeProxyCachePathForSnapshot(snapshot.CacheEnabled, snapshot.CachePath)
+	return snapshot
+}
+
+func parseOriginErrorPageStatusCodes(raw string) []string {
+	const defaultTag = "500-599"
+	trimmed := strings.TrimSpace(raw)
+	if trimmed == "" {
+		return []string{defaultTag}
+	}
+	var tags []string
+	if err := json.Unmarshal([]byte(trimmed), &tags); err != nil || len(tags) == 0 {
+		return []string{defaultTag}
+	}
+	return tags
+}
+
+func normalizeProxyCachePathForSnapshot(cacheEnabled bool, cachePath string) string {
+	if !cacheEnabled {
+		return strings.TrimSpace(cachePath)
+	}
+	trimmed := strings.TrimSpace(cachePath)
+	if trimmed == "" || strings.HasPrefix(trimmed, "/var/") {
+		return openrestyrender.ProxyCachePathPlaceholder
+	}
+	return trimmed
+}
+
+func buildCertificateSupportFiles(ctx context.Context, routes []snapshotRoute) ([]SupportFile, error) {
+	certIDSet := make(map[uint]struct{})
+	for _, route := range routes {
+		for _, certID := range route.DomainCertIDs {
+			if certID != 0 {
+				certIDSet[certID] = struct{}{}
+			}
+		}
+	}
+	if len(certIDSet) == 0 {
+		return nil, nil
+	}
+	certIDs := make([]uint, 0, len(certIDSet))
+	for certID := range certIDSet {
+		certIDs = append(certIDs, certID)
+	}
+	slices.Sort(certIDs)
+	files := make([]SupportFile, 0, len(certIDs)*supportFilesPerCertificate)
+	for _, certID := range certIDs {
+		certificate, err := repository.GetTLSCertificateByID(ctx, certID)
+		if err != nil {
+			return nil, err
+		}
+		keyPEM, err := oftls.OpenKeyPEM(certificate.KeyPEM)
+		if err != nil {
+			return nil, fmt.Errorf("certificate %d private key: %w", certificate.ID, err)
+		}
+		if strings.TrimSpace(keyPEM) == "" {
+			return nil, fmt.Errorf("certificate %d has no private key", certificate.ID)
+		}
+		files = append(files,
+			SupportFile{Path: certificateCertFileName(certificate.ID), Content: normalizePEM(certificate.CertPEM)},
+			SupportFile{Path: certificateKeyFileName(certificate.ID), Content: normalizePEM(keyPEM)},
+		)
+	}
+	return dedupeSupportFiles(files), nil
+}

backend/openflare/plugins/server/domain/site/config_version/waf_graph_snapshot_test.go

@@ -0,0 +1,158 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package config_version
+
+import (
+	"context"
+	"encoding/json"
+	"strings"
+	"testing"
+
+	"Wavelet/openflare/plugins/server/kernel/repository"
+
+	"Wavelet/openflare/plugins/server/domain/waf"
+	"Wavelet/openflare/plugins/server/kernel/model"
+	db "Wavelet/plugins/infra/database"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestBuildSnapshotRejectsOversizedAggregateWAFIPGroups(t *testing.T) {
+	cleanup := setupConfigVersionTestDB(t)
+	defer cleanup()
+	ctx := context.Background()
+
+	// Each group remains below the existing 2 MiB per-subscription ceiling,
+	// while the complete Agent runtime document exceeds the aggregate limit.
+	ipList, err := json.Marshal(strings.Fields(strings.Repeat("192.0.2.1 ", 165000)))
+	require.NoError(t, err)
+	require.Less(t, len(ipList), 2<<20)
+
+	groupIDs := make([]uint, 0, 12)
+	for index := 0; index < 12; index++ {
+		group := &model.OpenFlareWAFIPGroup{
+			Name:    "aggregate-" + strings.Repeat("x", index),
+			Type:    "manual",
+			Enabled: true,
+			IPList:  string(ipList),
+		}
+		require.NoError(t, db.DB(ctx).Create(group).Error)
+		groupIDs = append(groupIDs, group.ID)
+	}
+	createSnapshotRule(t, ctx, "oversized-aggregate", snapshotIPMatchGraphForGroups(groupIDs))
+
+	_, err = buildSnapshotWAFDocument(ctx, nil)
+	require.ErrorContains(t, err, "WAF IP 组快照大小")
+	require.ErrorContains(t, err, "超过上限")
+}
+
+func TestWAFGraphSnapshotPreservesOrderAndGraphReferences(t *testing.T) {
+	cleanup := setupConfigVersionTestDB(t)
+	defer cleanup()
+	ctx := context.Background()
+
+	route := &model.ProxyRoute{SiteName: "ordered.example.com", OriginURL: "http://origin:8080", Upstreams: `["http://origin:8080"]`, Enabled: true}
+	require.NoError(t, repository.CreateProxyRouteRecord(ctx, route))
+	createSnapshotZoneDomains(t, ctx, route, route.SiteName)
+
+	referenced := &model.OpenFlareWAFIPGroup{Name: "referenced", Type: "manual", Enabled: true, IPList: `["192.0.2.1"]`}
+	unused := &model.OpenFlareWAFIPGroup{Name: "unused", Type: "manual", Enabled: true, IPList: `["198.51.100.1"]`}
+	require.NoError(t, db.DB(ctx).Create(referenced).Error)
+	require.NoError(t, db.DB(ctx).Create(unused).Error)
+
+	customA := createSnapshotRule(t, ctx, "custom-a", waf.DefaultRuleGraph())
+	customB := createSnapshotRule(t, ctx, "custom-b", snapshotIPMatchGraph(referenced.ID))
+	require.NoError(t, repository.ReplaceOpenFlareWAFSiteRuleGroupBindings(ctx, route.ID, []uint{customB.ID, customA.ID}))
+
+	snapshot, err := buildSnapshotWAFDocument(ctx, []*model.ProxyRoute{route})
+	require.NoError(t, err)
+	require.Len(t, snapshot.Bindings, 1)
+	assert.Equal(t, []uint{customB.ID, customA.ID}, snapshot.Bindings[0].RuleGroupIDs)
+	require.Len(t, snapshot.IPGroups, 1)
+	assert.Equal(t, referenced.ID, snapshot.IPGroups[0].ID)
+
+	var customBSnapshot *snapshotWAFRuleGroup
+	for index := range snapshot.RuleGroups {
+		if snapshot.RuleGroups[index].ID == customB.ID {
+			customBSnapshot = &snapshot.RuleGroups[index]
+		}
+	}
+	require.NotNil(t, customBSnapshot)
+	assert.Equal(t, "start", customBSnapshot.Graph.Entry)
+	assert.Equal(t, waf.RuleNodeIPMatch, customBSnapshot.Graph.Nodes["match"].Type)
+	raw, err := json.Marshal(customBSnapshot)
+	require.NoError(t, err)
+	assert.NotContains(t, string(raw), "position")
+	assert.NotContains(t, string(raw), "ip_whitelist")
+}
+
+func TestWAFGraphSnapshotEncodesEmptyBindingsAsArrays(t *testing.T) {
+	cleanup := setupConfigVersionTestDB(t)
+	defer cleanup()
+	ctx := context.Background()
+
+	route := &model.ProxyRoute{SiteName: "empty-binding.example.com", OriginURL: "http://origin:8080", Upstreams: `["http://origin:8080"]`, Enabled: true}
+	require.NoError(t, repository.CreateProxyRouteRecord(ctx, route))
+	createSnapshotZoneDomains(t, ctx, route, route.SiteName)
+
+	snapshot, err := buildSnapshotWAFDocument(ctx, []*model.ProxyRoute{route})
+	require.NoError(t, err)
+	require.Len(t, snapshot.Bindings, 1)
+	require.NotNil(t, snapshot.Bindings[0].RuleGroupIDs)
+
+	raw, err := json.Marshal(snapshot)
+	require.NoError(t, err)
+	assert.Contains(t, string(raw), `"rule_group_ids":[]`)
+	assert.NotContains(t, string(raw), `"rule_group_ids":null`)
+}
+
+func TestBuildSnapshotRejectsInvalidWAFGraph(t *testing.T) {
+	cleanup := setupConfigVersionTestDB(t)
+	defer cleanup()
+	ctx := context.Background()
+
+	invalid := &model.OpenFlareWAFRuleGroup{Name: "invalid", Enabled: true, Graph: `{"schema_version":1,"nodes":[],"edges":[]}`, Revision: 1}
+	require.NoError(t, db.DB(ctx).Create(invalid).Error)
+	_, err := buildSnapshotWAFDocument(ctx, nil)
+	require.ErrorContains(t, err, "invalid")
+}
+
+func createSnapshotRule(t *testing.T, ctx context.Context, name string, graph waf.RuleGraph) *model.OpenFlareWAFRuleGroup {
+	t.Helper()
+	raw, err := json.Marshal(graph)
+	require.NoError(t, err)
+	rule := &model.OpenFlareWAFRuleGroup{Name: name, Enabled: true, Graph: string(raw), Revision: 1}
+	require.NoError(t, db.DB(ctx).Create(rule).Error)
+	return rule
+}
+
+func snapshotIPMatchGraph(ipGroupID uint) waf.RuleGraph {
+	return snapshotIPMatchGraphForGroups([]uint{ipGroupID})
+}
+
+func snapshotIPMatchGraphForGroups(ipGroupIDs []uint) waf.RuleGraph {
+	config, _ := json.Marshal(waf.IPMatchConfig{IPGroupIDs: ipGroupIDs})
+	return waf.RuleGraph{SchemaVersion: waf.RuleGraphSchemaVersion, Nodes: []waf.RuleNode{
+		{ID: "start", Type: waf.RuleNodeStart, Position: waf.RulePosition{X: 1, Y: 2}, Config: json.RawMessage(`{}`)},
+		{ID: "match", Type: waf.RuleNodeIPMatch, Position: waf.RulePosition{X: 3, Y: 4}, Config: config},
+		{ID: "allow", Type: waf.RuleNodeAllow, Position: waf.RulePosition{X: 5, Y: 6}, Config: json.RawMessage(`{}`)},
+	}, Edges: []waf.RuleEdge{
+		{ID: "e1", Source: "start", SourceHandle: "next", Target: "match"},
+		{ID: "e2", Source: "match", SourceHandle: "true", Target: "allow"},
+		{ID: "e3", Source: "match", SourceHandle: "false", Target: "allow"},
+	}}
+}
+
+func snapshotPoWGraph() waf.RuleGraph {
+	config, _ := json.Marshal(waf.PoWNodeConfig{Algorithm: "fast", Difficulty: 4, SessionTTL: 600, ChallengeTTL: 300})
+	return waf.RuleGraph{SchemaVersion: waf.RuleGraphSchemaVersion, Nodes: []waf.RuleNode{
+		{ID: "start", Type: waf.RuleNodeStart, Config: json.RawMessage(`{}`)},
+		{ID: "pow", Type: waf.RuleNodePoW, Config: config},
+		{ID: "allow", Type: waf.RuleNodeAllow, Config: json.RawMessage(`{}`)},
+	}, Edges: []waf.RuleEdge{
+		{ID: "e1", Source: "start", SourceHandle: "next", Target: "pow"},
+		{ID: "e2", Source: "pow", SourceHandle: "next", Target: "allow"},
+	}}
+}