commit 9a588233d030288b457fc198233a1c71bf61303c
Author: longpeng <longpeng.m@msn.com>
Date:   Sun Aug 30 08:08:25 2026 +0800

    feat: implement config center phases 1-5

diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..90d28cb
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,7 @@
+.git
+.env
+bin
+coverage.out
+web/dist
+web/node_modules
+*.log
diff --git a/.env.example b/.env.example
new file mode 100644
index 0000000..e6e3792
--- /dev/null
+++ b/.env.example
@@ -0,0 +1,14 @@
+HTTP_ADDR=:8080
+DATABASE_URL=postgres://configcenter:configcenter@localhost:5432/configcenter?sslmode=disable
+ETCD_ENDPOINTS=http://localhost:2379
+ETCD_DIAL_TIMEOUT=5s
+OUTBOX_INTERVAL=500ms
+OUTBOX_BATCH_SIZE=50
+OUTBOX_MAX_RETRY=12
+CORS_ALLOWED_ORIGINS=http://localhost:5173
+AUTH_ENABLED=false
+JWT_SECRET=replace-with-at-least-32-random-characters
+JWT_TTL=8h
+BOOTSTRAP_ADMIN_USERNAME=admin
+BOOTSTRAP_ADMIN_PASSWORD=replace-with-at-least-12-characters
+BOOTSTRAP_ADMIN_DISPLAY_NAME=Administrator
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..7f31b2b
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,10 @@
+.env
+.idea/
+.vscode/
+bin/
+coverage.out
+web/dist/
+web/node_modules/
+*.log
+__pycache__/
+*.pyc
diff --git a/ConfigCenter.jsx b/ConfigCenter.jsx
new file mode 100644
index 0000000..2956548
--- /dev/null
+++ b/ConfigCenter.jsx
@@ -0,0 +1,1371 @@
+import React, { useState, useEffect } from 'react';
+import {
+  Package, FolderTree, Globe, SlidersHorizontal, Plus, Pencil, Trash2,
+  Search, X, UploadCloud, History, RotateCcw, AlertTriangle, Check,
+  LockKeyhole, GitBranch, Users, LogOut, ShieldCheck,
+} from 'lucide-react';
+import { api } from './web/src/api.js';
+
+/* =========================================================================
+ * 工具函数
+ * ========================================================================= */
+let idCounter = 1000;
+function genId(prefix) {
+  idCounter += 1;
+  return `${prefix}-${idCounter}`;
+}
+function nowStr() {
+  const d = new Date();
+  const p = (n) => String(n).padStart(2, '0');
+  return `${d.getFullYear()}-${p(d.getMonth() + 1)}-${p(d.getDate())} ${p(d.getHours())}:${p(d.getMinutes())}`;
+}
+function todayStr() {
+  const d = new Date();
+  const p = (n) => String(n).padStart(2, '0');
+  return `${d.getFullYear()}-${p(d.getMonth() + 1)}-${p(d.getDate())}`;
+}
+
+const ENV_STYLES = {
+  DEV: { badge: 'bg-emerald-50 text-emerald-700 border-emerald-200', dot: 'bg-emerald-500' },
+  TEST: { badge: 'bg-amber-50 text-amber-700 border-amber-200', dot: 'bg-amber-500' },
+  STAGING: { badge: 'bg-violet-50 text-violet-700 border-violet-200', dot: 'bg-violet-500' },
+  PROD: { badge: 'bg-rose-50 text-rose-700 border-rose-200', dot: 'bg-rose-500' },
+};
+function envStyle(code) {
+  return ENV_STYLES[code] || { badge: 'bg-slate-100 text-slate-700 border-slate-200', dot: 'bg-slate-400' };
+}
+const TYPE_BADGE = {
+  properties: 'bg-slate-100 text-slate-600',
+  yaml: 'bg-indigo-50 text-indigo-600',
+  json: 'bg-amber-50 text-amber-600',
+  xml: 'bg-violet-50 text-violet-600',
+};
+
+/* =========================================================================
+ * 种子数据
+ * ========================================================================= */
+const initialEnvironments = [
+  { id: 'env-dev', code: 'DEV', name: '开发环境', desc: '开发联调使用', order: 1 },
+  { id: 'env-test', code: 'TEST', name: '测试环境', desc: 'QA 测试验证', order: 2 },
+  { id: 'env-staging', code: 'STAGING', name: '预发环境', desc: '上线前灰度验证', order: 3 },
+  { id: 'env-prod', code: 'PROD', name: '生产环境', desc: '线上正式环境', order: 4 },
+];
+
+const initialApps = [
+  { id: 'app-user', code: 'user-service', name: '用户服务', department: '平台架构部', owner: '张伟', desc: '用户注册、登录与账户中心', createdAt: '2026-01-10' },
+  { id: 'app-order', code: 'order-service', name: '订单服务', department: '交易平台部', owner: '李娜', desc: '订单创建、支付与售后流程', createdAt: '2026-02-15' },
+  { id: 'app-gateway', code: 'api-gateway', name: 'API 网关', department: '平台架构部', owner: '王强', desc: '统一流量入口与路由转发', createdAt: '2026-01-22' },
+];
+
+const initialNamespaces = [
+  { id: 'ns-user-app', appId: 'app-user', name: 'application', type: 'properties', desc: '默认应用配置' },
+  { id: 'ns-user-db', appId: 'app-user', name: 'database', type: 'yaml', desc: '数据库连接配置' },
+  { id: 'ns-order-app', appId: 'app-order', name: 'application', type: 'properties', desc: '默认应用配置' },
+  { id: 'ns-gateway-app', appId: 'app-gateway', name: 'application', type: 'properties', desc: '默认应用配置' },
+  { id: 'ns-gateway-routes', appId: 'app-gateway', name: 'routes', type: 'json', desc: '路由与限流规则' },
+];
+
+const rawConfigs = [
+  { appId: 'app-user', nsId: 'ns-user-app', envId: 'env-dev', key: 'server.port', value: '8080', comment: '服务监听端口', released: true },
+  { appId: 'app-user', nsId: 'ns-user-app', envId: 'env-dev', key: 'feature.newLogin.enabled', value: 'true', comment: '新登录页灰度开关', released: true },
+  { appId: 'app-user', nsId: 'ns-user-app', envId: 'env-dev', key: 'log.level', value: 'INFO', releasedValueOverride: 'DEBUG', comment: '日志级别' },
+  { appId: 'app-user', nsId: 'ns-user-app', envId: 'env-test', key: 'server.port', value: '8080', released: true },
+  { appId: 'app-user', nsId: 'ns-user-app', envId: 'env-test', key: 'feature.newLogin.enabled', value: 'false', released: true },
+  { appId: 'app-user', nsId: 'ns-user-app', envId: 'env-prod', key: 'server.port', value: '8080', released: true },
+  { appId: 'app-user', nsId: 'ns-user-app', envId: 'env-prod', key: 'feature.newLogin.enabled', value: 'false', released: true },
+  { appId: 'app-user', nsId: 'ns-user-app', envId: 'env-prod', key: 'rate.limit.qps', value: '500', comment: '接口限流阈值', released: true, pendingDelete: true },
+  { appId: 'app-user', nsId: 'ns-user-app', envId: 'env-prod', key: 'cache.ttl.seconds', value: '300', comment: '缓存过期时间' },
+  { appId: 'app-user', nsId: 'ns-user-db', envId: 'env-dev', key: 'db.url', value: 'jdbc:mysql://dev-db:3306/user', comment: '数据库连接地址', released: true },
+  { appId: 'app-user', nsId: 'ns-user-db', envId: 'env-dev', key: 'db.pool.size', value: '10', released: true },
+  { appId: 'app-user', nsId: 'ns-user-db', envId: 'env-prod', key: 'db.url', value: 'jdbc:mysql://prod-db-vip:3306/user', released: true },
+  { appId: 'app-user', nsId: 'ns-user-db', envId: 'env-prod', key: 'db.pool.size', value: '50', released: true },
+  { appId: 'app-order', nsId: 'ns-order-app', envId: 'env-dev', key: 'pay.channel.default', value: 'alipay', comment: '默认支付渠道', released: true },
+  { appId: 'app-order', nsId: 'ns-order-app', envId: 'env-dev', key: 'order.timeout.minutes', value: '30', released: true },
+  { appId: 'app-order', nsId: 'ns-order-app', envId: 'env-test', key: 'pay.channel.default', value: 'alipay', released: true },
+  { appId: 'app-order', nsId: 'ns-order-app', envId: 'env-prod', key: 'pay.channel.default', value: 'wechat', released: true },
+  { appId: 'app-order', nsId: 'ns-order-app', envId: 'env-prod', key: 'order.timeout.minutes', value: '15', released: true },
+  { appId: 'app-gateway', nsId: 'ns-gateway-app', envId: 'env-dev', key: 'gateway.timeout.ms', value: '3000', released: true },
+  { appId: 'app-gateway', nsId: 'ns-gateway-app', envId: 'env-prod', key: 'gateway.timeout.ms', value: '1500', released: true },
+  { appId: 'app-gateway', nsId: 'ns-gateway-routes', envId: 'env-prod', key: 'routes.user-service', value: '/api/user/** -> user-service', comment: '用户服务路由规则', released: true },
+];
+const initialConfigs = rawConfigs.map((r) => ({
+  id: genId('cfg'),
+  appId: r.appId,
+  nsId: r.nsId,
+  envId: r.envId,
+  key: r.key,
+  value: r.value,
+  releasedValue: r.releasedValueOverride !== undefined ? r.releasedValueOverride : (r.released ? r.value : null),
+  pendingDelete: !!r.pendingDelete,
+  comment: r.comment || '',
+  updatedAt: '2026-08-25 14:30',
+}));
+
+const initialReleases = [
+  { id: genId('rel'), appId: 'app-user', nsId: 'ns-user-app', envId: 'env-prod', version: 1, time: '2026-07-01 10:00', operator: 'admin', comment: '初始化生产环境配置', added: 2, modified: 0, removed: 0, snapshot: { 'server.port': '8080', 'feature.newLogin.enabled': 'false' } },
+  { id: genId('rel'), appId: 'app-user', nsId: 'ns-user-app', envId: 'env-prod', version: 2, time: '2026-08-10 16:20', operator: 'admin', comment: '新增限流配置', added: 1, modified: 0, removed: 0, snapshot: { 'server.port': '8080', 'feature.newLogin.enabled': 'false', 'rate.limit.qps': '500' } },
+];
+
+/* =========================================================================
+ * 通用小组件
+ * ========================================================================= */
+function Field({ label, required, children }) {
+  return (
+    <label className="block">
+      <span className="block text-xs font-medium text-slate-500 mb-1">
+        {label}
+        {required && <span className="text-rose-500 ml-0.5">*</span>}
+      </span>
+      {children}
+    </label>
+  );
+}
+function inputCls(disabled) {
+  return `w-full rounded-lg border px-3 py-1.5 text-sm outline-none transition ${
+    disabled ? 'bg-slate-50 text-slate-400 border-slate-200 cursor-not-allowed' : 'border-slate-200 focus:border-indigo-400 focus:ring-2 focus:ring-indigo-100'
+  }`;
+}
+function EmptyHint({ text }) {
+  return <div className="bg-white rounded-xl border border-dashed border-slate-300 p-12 text-center text-sm text-slate-400">{text}</div>;
+}
+function Toast({ toast }) {
+  const tones = { success: 'bg-slate-900 text-white', danger: 'bg-rose-600 text-white' };
+  return (
+    <div className={`fixed bottom-6 left-1/2 -translate-x-1/2 z-50 px-4 py-2.5 rounded-lg shadow-lg text-sm flex items-center gap-2 ${tones[toast.tone] || tones.success}`}>
+      <Check size={16} /> {toast.msg}
+    </div>
+  );
+}
+
+function LoginPage({ onLogin }) {
+  const [username, setUsername] = useState('');
+  const [password, setPassword] = useState('');
+  const [error, setError] = useState('');
+  const [submitting, setSubmitting] = useState(false);
+
+  async function submit(e) {
+    e.preventDefault();
+    setSubmitting(true);
+    setError('');
+    try {
+      await onLogin(username, password);
+    } catch (err) {
+      setError(err.message);
+    } finally {
+      setSubmitting(false);
+    }
+  }
+
+  return (
+    <div className="min-h-screen bg-slate-950 flex items-center justify-center p-6">
+      <form onSubmit={submit} className="w-full max-w-sm rounded-2xl bg-white shadow-2xl p-7 space-y-5">
+        <div className="flex items-center gap-3">
+          <div className="w-10 h-10 rounded-xl bg-indigo-600 text-white flex items-center justify-center"><LockKeyhole size={19} /></div>
+          <div><h1 className="font-semibold text-slate-900">登录配置中心</h1><p className="text-xs text-slate-400 mt-0.5">使用管理员或应用成员账号</p></div>
+        </div>
+        <Field label="用户名" required><input autoFocus required value={username} onChange={(e) => setUsername(e.target.value)} className={inputCls()} autoComplete="username" /></Field>
+        <Field label="密码" required><input required type="password" value={password} onChange={(e) => setPassword(e.target.value)} className={inputCls()} autoComplete="current-password" /></Field>
+        {error && <p className="text-xs text-rose-600 bg-rose-50 rounded-lg px-3 py-2">{error}</p>}
+        <button disabled={submitting} className="w-full rounded-lg bg-indigo-600 text-white text-sm font-medium py-2.5 hover:bg-indigo-700 disabled:opacity-50">{submitting ? '登录中…' : '登录'}</button>
+      </form>
+    </div>
+  );
+}
+function ConfirmDialog({ confirm, onCancel }) {
+  return (
+    <div className="fixed inset-0 z-50 flex items-center justify-center bg-slate-900/40 backdrop-blur-sm p-4" onClick={onCancel}>
+      <div onClick={(e) => e.stopPropagation()} className="bg-white rounded-xl shadow-xl w-full max-w-sm p-5">
+        <div className="flex items-start gap-3">
+          <div className="shrink-0 w-9 h-9 rounded-full bg-rose-50 text-rose-500 flex items-center justify-center">
+            <AlertTriangle size={18} />
+          </div>
+          <div>
+            <h3 className="text-sm font-semibold text-slate-800">{confirm.title || '确认操作'}</h3>
+            <p className="text-sm text-slate-500 mt-1">{confirm.message}</p>
+          </div>
+        </div>
+        <div className="mt-5 flex justify-end gap-2">
+          <button onClick={onCancel} className="px-3 py-1.5 text-sm rounded-lg text-slate-600 hover:bg-slate-100">取消</button>
+          <button onClick={confirm.onConfirm} className="px-3 py-1.5 text-sm rounded-lg bg-rose-600 text-white hover:bg-rose-700">
+            {confirm.confirmLabel || '确认删除'}
+          </button>
+        </div>
+      </div>
+    </div>
+  );
+}
+
+/* =========================================================================
+ * 新建 / 编辑 弹窗（应用、命名空间、环境、配置项 共用）
+ * ========================================================================= */
+function EntityModal({ modal, apps, onClose, onSubmit }) {
+  const { entityType, mode, data } = modal;
+  const [form, setForm] = useState(() => data || {});
+  const set = (k, v) => setForm((f) => ({ ...f, [k]: v }));
+
+  const titles = {
+    app: mode === 'add' ? '新建应用' : '编辑应用',
+    namespace: mode === 'add' ? '新建命名空间' : '编辑命名空间',
+    environment: mode === 'add' ? '新建环境' : '编辑环境',
+    config: mode === 'add' ? '添加配置项' : '编辑配置项',
+  };
+
+  function handleSubmit(e) {
+    e.preventDefault();
+    onSubmit(form);
+  }
+
+  return (
+    <div className="fixed inset-0 z-50 flex items-center justify-center bg-slate-900/40 backdrop-blur-sm p-4" onClick={onClose}>
+      <form onClick={(e) => e.stopPropagation()} onSubmit={handleSubmit} className="bg-white rounded-xl shadow-xl w-full max-w-md overflow-hidden">
+        <div className="px-5 py-4 border-b border-slate-100 flex items-center justify-between">
+          <h3 className="text-sm font-semibold text-slate-800">{titles[entityType]}</h3>
+          <button type="button" onClick={onClose} className="text-slate-400 hover:text-slate-600">
+            <X size={18} />
+          </button>
+        </div>
+
+        <div className="px-5 py-4 space-y-4 max-h-[70vh] overflow-y-auto">
+          {entityType === 'app' && (
+            <>
+              <Field label="应用 ID" required>
+                <input required disabled={mode === 'edit'} value={form.code || ''} onChange={(e) => set('code', e.target.value)} placeholder="如 user-service" className={inputCls(mode === 'edit') + ' font-mono'} />
+              </Field>
+              <Field label="应用名称" required>
+                <input required value={form.name || ''} onChange={(e) => set('name', e.target.value)} className={inputCls()} />
+              </Field>
+              <Field label="所属部门">
+                <input value={form.department || ''} onChange={(e) => set('department', e.target.value)} className={inputCls()} />
+              </Field>
+              <Field label="负责人">
+                <input value={form.owner || ''} onChange={(e) => set('owner', e.target.value)} className={inputCls()} />
+              </Field>
+              <Field label="描述">
+                <textarea value={form.desc || ''} onChange={(e) => set('desc', e.target.value)} rows={2} className={inputCls()} />
+              </Field>
+            </>
+          )}
+
+          {entityType === 'namespace' && (
+            <>
+              <Field label="所属应用" required>
+                <select required disabled={mode === 'edit'} value={form.appId || ''} onChange={(e) => set('appId', e.target.value)} className={inputCls(mode === 'edit')}>
+                  <option value="" disabled>请选择应用</option>
+                  {apps.map((a) => (
+                    <option key={a.id} value={a.id}>{a.name}</option>
+                  ))}
+                </select>
+              </Field>
+              <Field label="命名空间名称" required>
+                <input required disabled={mode === 'edit'} value={form.name || ''} onChange={(e) => set('name', e.target.value)} placeholder="如 application" className={inputCls(mode === 'edit') + ' font-mono'} />
+              </Field>
+              <Field label="格式类型" required>
+                <select required value={form.type || 'properties'} onChange={(e) => set('type', e.target.value)} className={inputCls()}>
+                  <option value="properties">properties</option>
+                  <option value="yaml">yaml</option>
+                  <option value="json">json</option>
+                  <option value="xml">xml</option>
+                </select>
+              </Field>
+              <Field label="描述">
+                <textarea value={form.desc || ''} onChange={(e) => set('desc', e.target.value)} rows={2} className={inputCls()} />
+              </Field>
+            </>
+          )}
+
+          {entityType === 'environment' && (
+            <>
+              <Field label="环境编码" required>
+                <input required disabled={mode === 'edit'} value={form.code || ''} onChange={(e) => set('code', e.target.value.toUpperCase())} placeholder="如 DEV" className={inputCls(mode === 'edit') + ' font-mono'} />
+              </Field>
+              <Field label="环境名称" required>
+                <input required value={form.name || ''} onChange={(e) => set('name', e.target.value)} className={inputCls()} />
+              </Field>
+              <Field label="排序">
+                <input type="number" value={form.order ?? 0} onChange={(e) => set('order', Number(e.target.value))} className={inputCls()} />
+              </Field>
+              <Field label="描述">
+                <textarea value={form.desc || ''} onChange={(e) => set('desc', e.target.value)} rows={2} className={inputCls()} />
+              </Field>
+            </>
+          )}
+
+          {entityType === 'config' && (
+            <>
+              <Field label="Key" required>
+                <input required disabled={mode === 'edit'} value={form.key || ''} onChange={(e) => set('key', e.target.value)} placeholder="如 server.port" className={inputCls(mode === 'edit') + ' font-mono'} />
+              </Field>
+              <Field label="Value" required>
+                <textarea required value={form.value || ''} onChange={(e) => set('value', e.target.value)} rows={4} className={inputCls() + ' font-mono'} />
+              </Field>
+              <Field label="备注">
+                <input value={form.comment || ''} onChange={(e) => set('comment', e.target.value)} className={inputCls()} />
+              </Field>
+            </>
+          )}
+        </div>
+
+        <div className="px-5 py-3 border-t border-slate-100 flex justify-end gap-2 bg-slate-50">
+          <button type="button" onClick={onClose} className="px-3 py-1.5 text-sm rounded-lg text-slate-600 hover:bg-slate-100">取消</button>
+          <button type="submit" className="px-3 py-1.5 text-sm rounded-lg bg-indigo-600 text-white hover:bg-indigo-700">保存</button>
+        </div>
+      </form>
+    </div>
+  );
+}
+
+/* =========================================================================
+ * 发布 弹窗（diff 预览）
+ * ========================================================================= */
+function isPendingItem(c) {
+  return c.pendingDelete || c.releasedValue === null || c.value !== c.releasedValue;
+}
+function PublishModal({ scopeConfigs, appName, nsName, envCode, comment, setComment, onCancel, onConfirm }) {
+  const pending = scopeConfigs.filter(isPendingItem);
+  return (
+    <div className="fixed inset-0 z-50 flex items-center justify-center bg-slate-900/40 backdrop-blur-sm p-4" onClick={onCancel}>
+      <div onClick={(e) => e.stopPropagation()} className="bg-white rounded-xl shadow-xl w-full max-w-lg overflow-hidden flex flex-col max-h-[85vh]">
+        <div className="px-5 py-4 border-b border-slate-100">
+          <h3 className="text-sm font-semibold text-slate-800">发布配置</h3>
+          <p className="text-xs text-slate-400 mt-0.5">{appName} / {nsName} / {envCode} · 共 {pending.length} 项变更</p>
+        </div>
+        <div className="px-5 py-4 overflow-y-auto flex-1 space-y-1.5 bg-slate-900 font-mono text-xs leading-6">
+          {pending.length === 0 && <div className="text-slate-500">没有待发布的变更</div>}
+          {pending.map((c) => {
+            if (c.pendingDelete) {
+              return <div key={c.id} className="text-rose-400">- {c.key} = {c.releasedValue}</div>;
+            }
+            if (c.releasedValue === null) {
+              return <div key={c.id} className="text-emerald-400">+ {c.key} = {c.value}</div>;
+            }
+            return (
+              <div key={c.id}>
+                <div className="text-rose-400">- {c.key} = {c.releasedValue}</div>
+                <div className="text-emerald-400">+ {c.key} = {c.value}</div>
+              </div>
+            );
+          })}
+        </div>
+        <div className="px-5 py-4 border-t border-slate-100 space-y-3">
+          <Field label="发布说明">
+            <input value={comment} onChange={(e) => setComment(e.target.value)} placeholder="本次发布的变更说明（选填）" className={inputCls()} />
+          </Field>
+          <div className="flex justify-end gap-2">
+            <button onClick={onCancel} className="px-3 py-1.5 text-sm rounded-lg text-slate-600 hover:bg-slate-100">取消</button>
+            <button onClick={onConfirm} disabled={pending.length === 0} className="px-3 py-1.5 text-sm rounded-lg bg-emerald-600 text-white hover:bg-emerald-700 disabled:opacity-40">确认发布</button>
+          </div>
+        </div>
+      </div>
+    </div>
+  );
+}
+
+/* =========================================================================
+ * 发布历史 弹窗
+ * ========================================================================= */
+function HistoryModal({ releases, appName, nsName, envCode, onClose, onRollback }) {
+  const sorted = [...releases].sort((a, b) => b.version - a.version);
+  const latestVersion = sorted[0]?.version;
+  return (
+    <div className="fixed inset-0 z-50 flex items-center justify-center bg-slate-900/40 backdrop-blur-sm p-4" onClick={onClose}>
+      <div onClick={(e) => e.stopPropagation()} className="bg-white rounded-xl shadow-xl w-full max-w-lg overflow-hidden flex flex-col max-h-[85vh]">
+        <div className="px-5 py-4 border-b border-slate-100 flex items-center justify-between">
+          <div>
+            <h3 className="text-sm font-semibold text-slate-800">发布历史</h3>
+            <p className="text-xs text-slate-400 mt-0.5">{appName} / {nsName} / {envCode}</p>
+          </div>
+          <button onClick={onClose} className="text-slate-400 hover:text-slate-600">
+            <X size={18} />
+          </button>
+        </div>
+        <div className="overflow-y-auto flex-1 divide-y divide-slate-100">
+          {sorted.length === 0 && <div className="px-5 py-10 text-center text-sm text-slate-400">暂无发布记录</div>}
+          {sorted.map((r) => (
+            <div key={r.id} className="px-5 py-3.5 flex items-start justify-between gap-3">
+              <div>
+                <div className="flex items-center gap-2 flex-wrap">
+                  <span className="px-2 py-0.5 rounded bg-indigo-50 text-indigo-600 text-xs font-mono font-medium">v{r.version}</span>
+                  <span className="text-xs text-slate-400">{r.time}</span>
+                  <span className="text-xs text-slate-400">by {r.operator}</span>
+                  <span className={`px-1.5 py-0.5 rounded text-[10px] font-medium ${r.status === 'applied' ? 'bg-emerald-50 text-emerald-600' : r.status === 'failed' ? 'bg-rose-50 text-rose-600' : 'bg-amber-50 text-amber-600'}`}>
+                    {r.status === 'applied' ? '已生效' : r.status === 'failed' ? '失败' : '下发中'}
+                  </span>
+                </div>
+                <p className="text-sm text-slate-700 mt-1">{r.comment || '无发布说明'}</p>
+                <p className="text-xs text-slate-400 mt-1">
+                  <span className="text-emerald-600">+{r.added}</span>{' '}
+                  <span className="text-amber-600">~{r.modified}</span>{' '}
+                  <span className="text-rose-500">-{r.removed}</span>
+                </p>
+              </div>
+              {r.version !== latestVersion && (
+                <button onClick={() => onRollback(r)} className="shrink-0 flex items-center gap-1 px-2.5 py-1.5 rounded-lg border border-slate-200 text-xs text-slate-600 hover:bg-slate-50">
+                  <RotateCcw size={13} /> 回滚
+                </button>
+              )}
+            </div>
+          ))}
+        </div>
+      </div>
+    </div>
+  );
+}
+
+/* =========================================================================
+ * 侧边导航 / 顶部栏
+ * ========================================================================= */
+const NAV_ITEMS = [
+  { key: 'configs', label: '配置管理', icon: SlidersHorizontal },
+  { key: 'gray', label: '灰度规则', icon: GitBranch },
+  { key: 'apps', label: '应用管理', icon: Package },
+  { key: 'namespaces', label: '命名空间管理', icon: FolderTree },
+  { key: 'environments', label: '环境管理', icon: Globe },
+  { key: 'users', label: '用户与权限', icon: Users, adminOnly: true },
+];
+function Sidebar({ nav, setNav, identity, onLogout }) {
+  const items = NAV_ITEMS.filter((item) => !item.adminOnly || identity?.user?.isAdmin);
+  return (
+    <aside className="w-56 shrink-0 bg-slate-900 text-slate-300 flex flex-col">
+      <div className="h-14 flex items-center gap-2 px-5 border-b border-slate-800">
+        <div className="w-7 h-7 rounded-md bg-indigo-500 flex items-center justify-center text-white font-bold text-sm">C</div>
+        <span className="text-white font-semibold text-sm tracking-wide">配置中心</span>
+      </div>
+      <nav className="flex-1 py-3 px-2 space-y-1">
+        {items.map((item) => {
+          const Icon = item.icon;
+          const active = nav === item.key;
+          return (
+            <button
+              key={item.key}
+              onClick={() => setNav(item.key)}
+              className={`w-full flex items-center gap-2.5 px-3 py-2 rounded-lg text-sm transition ${active ? 'bg-indigo-600 text-white' : 'hover:bg-slate-800 hover:text-white'}`}
+            >
+              <Icon size={16} /> {item.label}
+            </button>
+          );
+        })}
+      </nav>
+      <div className="px-3 py-3 border-t border-slate-800">
+        <div className="px-2 text-xs text-slate-400 truncate">{identity?.user?.displayName || identity?.user?.username || 'Config Center'}</div>
+        <div className="px-2 mt-0.5 text-[10px] text-slate-600">{identity?.user?.isAdmin ? '系统管理员' : '应用成员'}</div>
+        {identity?.authEnabled && (
+          <button onClick={onLogout} className="mt-2 w-full flex items-center gap-2 px-2 py-1.5 rounded text-xs text-slate-400 hover:bg-slate-800 hover:text-white">
+            <LogOut size={13} /> 退出登录
+          </button>
+        )}
+      </div>
+    </aside>
+  );
+}
+const PAGE_META = {
+  configs: { title: '配置管理', desc: '按应用 / 环境 / 命名空间管理配置项，支持发布与回滚' },
+  gray: { title: '灰度规则', desc: '按 IP、实例或稳定百分比覆盖已发布配置' },
+  apps: { title: '应用管理', desc: '管理接入配置中心的应用' },
+  namespaces: { title: '命名空间管理', desc: '管理各应用下的配置命名空间' },
+  environments: { title: '环境管理', desc: '管理配置生效的环境' },
+  users: { title: '用户与权限', desc: '创建用户并分配应用级 viewer / app-owner 角色' },
+};
+function TopBar({ nav }) {
+  const meta = PAGE_META[nav];
+  return (
+    <header className="h-14 shrink-0 flex items-center justify-between px-6 border-b border-slate-200 bg-white">
+      <h1 className="text-sm font-semibold text-slate-800">{meta.title}</h1>
+      <div className="text-xs text-slate-400 hidden sm:block">{meta.desc}</div>
+    </header>
+  );
+}
+
+/* =========================================================================
+ * 应用管理 页面
+ * ========================================================================= */
+function AppsPage({ apps, namespaces, search, setSearch, onAdd, onEdit, onDelete }) {
+  const kw = search.toLowerCase();
+  const filtered = apps.filter((a) => `${a.code}${a.name}${a.department}${a.owner}`.toLowerCase().includes(kw));
+  return (
+    <div className="space-y-4">
+      <div className="flex items-center justify-between gap-3 flex-wrap">
+        <div className="relative w-72 max-w-full">
+          <Search size={15} className="absolute left-3 top-2.5 text-slate-400" />
+          <input value={search} onChange={(e) => setSearch(e.target.value)} placeholder="搜索应用 ID / 名称 / 负责人" className="w-full pl-8 pr-3 py-2 text-sm rounded-lg border border-slate-200 focus:border-indigo-400 focus:ring-2 focus:ring-indigo-100 outline-none" />
+        </div>
+        <button onClick={onAdd} className="flex items-center gap-1.5 px-3 py-2 text-sm rounded-lg bg-indigo-600 text-white hover:bg-indigo-700">
+          <Plus size={15} /> 新建应用
+        </button>
+      </div>
+      <div className="bg-white rounded-xl border border-slate-200 overflow-hidden">
+        <div className="overflow-x-auto">
+          <table className="w-full text-sm min-w-[760px]">
+            <thead className="bg-slate-50 text-slate-500 text-xs uppercase tracking-wide">
+              <tr>
+                <th className="text-left font-medium px-4 py-2.5">应用 ID</th>
+                <th className="text-left font-medium px-4 py-2.5">应用名称</th>
+                <th className="text-left font-medium px-4 py-2.5">所属部门</th>
+                <th className="text-left font-medium px-4 py-2.5">负责人</th>
+                <th className="text-left font-medium px-4 py-2.5">命名空间</th>
+                <th className="text-left font-medium px-4 py-2.5">创建时间</th>
+                <th className="text-right font-medium px-4 py-2.5">操作</th>
+              </tr>
+            </thead>
+            <tbody className="divide-y divide-slate-100">
+              {filtered.map((a) => (
+                <tr key={a.id} className="hover:bg-slate-50/70">
+                  <td className="px-4 py-2.5 font-mono text-xs text-slate-600">{a.code}</td>
+                  <td className="px-4 py-2.5 font-medium text-slate-800">{a.name}</td>
+                  <td className="px-4 py-2.5 text-slate-500">{a.department || '-'}</td>
+                  <td className="px-4 py-2.5 text-slate-500">{a.owner || '-'}</td>
+                  <td className="px-4 py-2.5 text-slate-500">{namespaces.filter((n) => n.appId === a.id).length}</td>
+                  <td className="px-4 py-2.5 text-slate-400 text-xs">{a.createdAt}</td>
+                  <td className="px-4 py-2.5">
+                    <div className="flex justify-end gap-1">
+                      <button onClick={() => onEdit(a)} className="p-1.5 rounded-md text-slate-400 hover:text-indigo-600 hover:bg-indigo-50"><Pencil size={14} /></button>
+                      <button onClick={() => onDelete(a)} className="p-1.5 rounded-md text-slate-400 hover:text-rose-600 hover:bg-rose-50"><Trash2 size={14} /></button>
+                    </div>
+                  </td>
+                </tr>
+              ))}
+              {filtered.length === 0 && (
+                <tr><td colSpan={7} className="px-4 py-10 text-center text-sm text-slate-400">没有找到匹配的应用</td></tr>
+              )}
+            </tbody>
+          </table>
+        </div>
+      </div>
+    </div>
+  );
+}
+
+/* =========================================================================
+ * 命名空间管理 页面
+ * ========================================================================= */
+function NamespacesPage({ namespaces, apps, search, setSearch, filterAppId, setFilterAppId, onAdd, onEdit, onDelete }) {
+  const appName = (id) => apps.find((a) => a.id === id)?.name || '未知应用';
+  const kw = search.toLowerCase();
+  const filtered = namespaces.filter((n) => (filterAppId === 'all' || n.appId === filterAppId) && `${n.name}${n.desc}`.toLowerCase().includes(kw));
+  return (
+    <div className="space-y-4">
+      <div className="flex items-center justify-between gap-3 flex-wrap">
+        <div className="flex items-center gap-2 flex-wrap">
+          <select value={filterAppId} onChange={(e) => setFilterAppId(e.target.value)} className="px-3 py-2 text-sm rounded-lg border border-slate-200 outline-none focus:border-indigo-400">
+            <option value="all">全部应用</option>
+            {apps.map((a) => (<option key={a.id} value={a.id}>{a.name}</option>))}
+          </select>
+          <div className="relative w-64 max-w-full">
+            <Search size={15} className="absolute left-3 top-2.5 text-slate-400" />
+            <input value={search} onChange={(e) => setSearch(e.target.value)} placeholder="搜索命名空间" className="w-full pl-8 pr-3 py-2 text-sm rounded-lg border border-slate-200 focus:border-indigo-400 focus:ring-2 focus:ring-indigo-100 outline-none" />
+          </div>
+        </div>
+        <button onClick={onAdd} className="flex items-center gap-1.5 px-3 py-2 text-sm rounded-lg bg-indigo-600 text-white hover:bg-indigo-700">
+          <Plus size={15} /> 新建命名空间
+        </button>
+      </div>
+      <div className="bg-white rounded-xl border border-slate-200 overflow-hidden">
+        <div className="overflow-x-auto">
+          <table className="w-full text-sm min-w-[640px]">
+            <thead className="bg-slate-50 text-slate-500 text-xs uppercase tracking-wide">
+              <tr>
+                <th className="text-left font-medium px-4 py-2.5">所属应用</th>
+                <th className="text-left font-medium px-4 py-2.5">命名空间</th>
+                <th className="text-left font-medium px-4 py-2.5">格式</th>
+                <th className="text-left font-medium px-4 py-2.5">描述</th>
+                <th className="text-right font-medium px-4 py-2.5">操作</th>
+              </tr>
+            </thead>
+            <tbody className="divide-y divide-slate-100">
+              {filtered.map((n) => (
+                <tr key={n.id} className="hover:bg-slate-50/70">
+                  <td className="px-4 py-2.5 text-slate-600">{appName(n.appId)}</td>
+                  <td className="px-4 py-2.5 font-mono text-xs font-medium text-slate-800">{n.name}</td>
+                  <td className="px-4 py-2.5"><span className={`px-2 py-0.5 rounded text-xs font-mono ${TYPE_BADGE[n.type]}`}>{n.type}</span></td>
+                  <td className="px-4 py-2.5 text-slate-500">{n.desc || '-'}</td>
+                  <td className="px-4 py-2.5">
+                    <div className="flex justify-end gap-1">
+                      <button onClick={() => onEdit(n)} className="p-1.5 rounded-md text-slate-400 hover:text-indigo-600 hover:bg-indigo-50"><Pencil size={14} /></button>
+                      <button onClick={() => onDelete(n)} className="p-1.5 rounded-md text-slate-400 hover:text-rose-600 hover:bg-rose-50"><Trash2 size={14} /></button>
+                    </div>
+                  </td>
+                </tr>
+              ))}
+              {filtered.length === 0 && (
+                <tr><td colSpan={5} className="px-4 py-10 text-center text-sm text-slate-400">没有找到匹配的命名空间</td></tr>
+              )}
+            </tbody>
+          </table>
+        </div>
+      </div>
+    </div>
+  );
+}
+
+/* =========================================================================
+ * 环境管理 页面
+ * ========================================================================= */
+function EnvironmentsPage({ environments, onAdd, onEdit, onDelete }) {
+  const sorted = [...environments].sort((a, b) => a.order - b.order);
+  return (
+    <div className="space-y-4">
+      <div className="flex items-center justify-end">
+        <button onClick={onAdd} className="flex items-center gap-1.5 px-3 py-2 text-sm rounded-lg bg-indigo-600 text-white hover:bg-indigo-700">
+          <Plus size={15} /> 新建环境
+        </button>
+      </div>
+      <div className="bg-white rounded-xl border border-slate-200 overflow-hidden">
+        <div className="overflow-x-auto">
+          <table className="w-full text-sm min-w-[560px]">
+            <thead className="bg-slate-50 text-slate-500 text-xs uppercase tracking-wide">
+              <tr>
+                <th className="text-left font-medium px-4 py-2.5 w-16">排序</th>
+                <th className="text-left font-medium px-4 py-2.5">环境编码</th>
+                <th className="text-left font-medium px-4 py-2.5">环境名称</th>
+                <th className="text-left font-medium px-4 py-2.5">描述</th>
+                <th className="text-right font-medium px-4 py-2.5">操作</th>
+              </tr>
+            </thead>
+            <tbody className="divide-y divide-slate-100">
+              {sorted.map((env) => {
+                const st = envStyle(env.code);
+                return (
+                  <tr key={env.id} className="hover:bg-slate-50/70">
+                    <td className="px-4 py-2.5 text-slate-400">{env.order}</td>
+                    <td className="px-4 py-2.5">
+                      <span className={`inline-flex items-center gap-1.5 px-2 py-0.5 rounded border text-xs font-mono font-medium ${st.badge}`}>
+                        <span className={`w-1.5 h-1.5 rounded-full ${st.dot}`} />{env.code}
+                      </span>
+                    </td>
+                    <td className="px-4 py-2.5 font-medium text-slate-800">{env.name}</td>
+                    <td className="px-4 py-2.5 text-slate-500">{env.desc || '-'}</td>
+                    <td className="px-4 py-2.5">
+                      <div className="flex justify-end gap-1">
+                        <button onClick={() => onEdit(env)} className="p-1.5 rounded-md text-slate-400 hover:text-indigo-600 hover:bg-indigo-50"><Pencil size={14} /></button>
+                        <button onClick={() => onDelete(env)} className="p-1.5 rounded-md text-slate-400 hover:text-rose-600 hover:bg-rose-50"><Trash2 size={14} /></button>
+                      </div>
+                    </td>
+                  </tr>
+                );
+              })}
+            </tbody>
+          </table>
+        </div>
+      </div>
+    </div>
+  );
+}
+
+/* =========================================================================
+ * 配置管理 页面（核心）
+ * ========================================================================= */
+function ConfigsPage(props) {
+  const {
+    apps, environments, namespaces, configs,
+    selectedAppId, setSelectedAppId, selectedEnvId, setSelectedEnvId, selectedNsId, setSelectedNsId,
+    search, setSearch, onAddConfig, onEditConfig, onToggleDelete, onOpenPublish, onOpenHistory,
+  } = props;
+
+  if (apps.length === 0) {
+    return <EmptyHint text="请先在「应用管理」中创建应用" />;
+  }
+
+  const appNamespaces = namespaces.filter((n) => n.appId === selectedAppId);
+  const sortedEnvs = [...environments].sort((a, b) => a.order - b.order);
+  const scopeConfigs = configs.filter((c) => c.appId === selectedAppId && c.nsId === selectedNsId && c.envId === selectedEnvId);
+  const pendingCount = scopeConfigs.filter(isPendingItem).length;
+  const kw = search.toLowerCase();
+  const filtered = scopeConfigs.filter((c) => c.key.toLowerCase().includes(kw));
+
+  return (
+    <div className="space-y-4">
+      <div className="bg-white rounded-xl border border-slate-200 p-4 space-y-3">
+        <div className="flex items-center gap-3">
+          <span className="text-xs font-medium text-slate-400 w-16 shrink-0">应用</span>
+          <select value={selectedAppId} onChange={(e) => setSelectedAppId(e.target.value)} className="px-3 py-1.5 text-sm rounded-lg border border-slate-200 outline-none focus:border-indigo-400 min-w-[220px]">
+            {apps.map((a) => (<option key={a.id} value={a.id}>{a.name} ({a.code})</option>))}
+          </select>
+        </div>
+        <div className="flex items-center gap-3">
+          <span className="text-xs font-medium text-slate-400 w-16 shrink-0">环境</span>
+          <div className="flex gap-1.5 flex-wrap">
+            {sortedEnvs.map((env) => {
+              const st = envStyle(env.code);
+              const active = env.id === selectedEnvId;
+              return (
+                <button
+                  key={env.id}
+                  onClick={() => setSelectedEnvId(env.id)}
+                  className={`px-3 py-1.5 rounded-lg text-xs font-mono font-medium border transition ${active ? st.badge + ' ring-1 ring-inset ring-current' : 'border-slate-200 text-slate-500 hover:bg-slate-50'}`}
+                >
+                  {env.code}
+                </button>
+              );
+            })}
+          </div>
+        </div>
+        <div className="flex items-center gap-3">
+          <span className="text-xs font-medium text-slate-400 w-16 shrink-0">命名空间</span>
+          {appNamespaces.length === 0 ? (
+            <span className="text-xs text-slate-400">该应用暂无命名空间，请先在「命名空间管理」中创建</span>
+          ) : (
+            <div className="flex gap-1.5 flex-wrap">
+              {appNamespaces.map((ns) => {
+                const active = ns.id === selectedNsId;
+                return (
+                  <button
+                    key={ns.id}
+                    onClick={() => setSelectedNsId(ns.id)}
+                    className={`px-3 py-1.5 rounded-lg text-xs font-mono font-medium border transition ${active ? 'bg-indigo-600 text-white border-indigo-600' : 'border-slate-200 text-slate-500 hover:bg-slate-50'}`}
+                  >
+                    {ns.name}
+                  </button>
+                );
+              })}
+            </div>
+          )}
+        </div>
+      </div>
+
+      <div className="flex items-center justify-between gap-3 flex-wrap">
+        <div className="relative w-64 max-w-full">
+          <Search size={15} className="absolute left-3 top-2.5 text-slate-400" />
+          <input value={search} onChange={(e) => setSearch(e.target.value)} placeholder="搜索 Key" className="w-full pl-8 pr-3 py-2 text-sm rounded-lg border border-slate-200 focus:border-indigo-400 focus:ring-2 focus:ring-indigo-100 outline-none" />
+        </div>
+        <div className="flex items-center gap-2 flex-wrap">
+          <button onClick={onOpenHistory} className="flex items-center gap-1.5 px-3 py-2 text-sm rounded-lg border border-slate-200 text-slate-600 hover:bg-slate-50">
+            <History size={15} /> 发布历史
+          </button>
+          <button onClick={onAddConfig} disabled={!selectedNsId} className="flex items-center gap-1.5 px-3 py-2 text-sm rounded-lg border border-slate-200 text-slate-600 hover:bg-slate-50 disabled:opacity-40">
+            <Plus size={15} /> 添加配置
+          </button>
+          <button
+            onClick={onOpenPublish}
+            disabled={pendingCount === 0}
+            className={`flex items-center gap-1.5 px-3 py-2 text-sm rounded-lg font-medium transition ${pendingCount > 0 ? 'bg-emerald-600 text-white hover:bg-emerald-700' : 'bg-slate-100 text-slate-400 cursor-not-allowed'}`}
+          >
+            <UploadCloud size={15} /> 发布{pendingCount > 0 ? ` (${pendingCount})` : ''}
+          </button>
+        </div>
+      </div>
+
+      <div className="bg-white rounded-xl border border-slate-200 overflow-hidden">
+        <div className="overflow-x-auto">
+          <table className="w-full text-sm min-w-[820px]">
+            <thead className="bg-slate-50 text-slate-500 text-xs uppercase tracking-wide">
+              <tr>
+                <th className="text-left font-medium px-4 py-2.5 w-1/5">Key</th>
+                <th className="text-left font-medium px-4 py-2.5 w-1/3">Value</th>
+                <th className="text-left font-medium px-4 py-2.5">备注</th>
+                <th className="text-left font-medium px-4 py-2.5">状态</th>
+                <th className="text-left font-medium px-4 py-2.5">更新时间</th>
+                <th className="text-right font-medium px-4 py-2.5">操作</th>
+              </tr>
+            </thead>
+            <tbody className="divide-y divide-slate-100">
+              {filtered.map((c) => {
+                const pending = isPendingItem(c);
+                const label = c.pendingDelete ? '待删除' : c.releasedValue === null ? '待发布·新增' : c.value !== c.releasedValue ? '待发布·修改' : '已发布';
+                const badgeCls = c.pendingDelete ? 'bg-rose-50 text-rose-600' : pending ? 'bg-amber-50 text-amber-600' : 'bg-slate-100 text-slate-500';
+                return (
+                  <tr key={c.id} className={`hover:bg-slate-50/70 ${c.pendingDelete ? 'opacity-60' : ''}`}>
+                    <td className="px-4 py-2.5 font-mono text-xs font-medium text-slate-800 align-top">{c.key}</td>
+                    <td className="px-4 py-2.5 font-mono text-xs text-slate-600 align-top whitespace-pre-wrap break-all">{c.value}</td>
+                    <td className="px-4 py-2.5 text-slate-500 align-top">{c.comment || '-'}</td>
+                    <td className="px-4 py-2.5 align-top"><span className={`px-2 py-0.5 rounded text-xs font-medium ${badgeCls}`}>{label}</span></td>
+                    <td className="px-4 py-2.5 text-slate-400 text-xs align-top">{c.updatedAt}</td>
+                    <td className="px-4 py-2.5 align-top">
+                      <div className="flex justify-end gap-1">
+                        {!c.pendingDelete && (
+                          <button onClick={() => onEditConfig(c)} className="p-1.5 rounded-md text-slate-400 hover:text-indigo-600 hover:bg-indigo-50"><Pencil size={14} /></button>
+                        )}
+                        <button
+                          onClick={() => onToggleDelete(c)}
+                          title={c.pendingDelete ? '撤销删除' : '删除'}
+                          className={`p-1.5 rounded-md ${c.pendingDelete ? 'text-amber-600 hover:bg-amber-50' : 'text-slate-400 hover:text-rose-600 hover:bg-rose-50'}`}
+                        >
+                          {c.pendingDelete ? <RotateCcw size={14} /> : <Trash2 size={14} />}
+                        </button>
+                      </div>
+                    </td>
+                  </tr>
+                );
+              })}
+              {filtered.length === 0 && (
+                <tr><td colSpan={6} className="px-4 py-10 text-center text-sm text-slate-400">{selectedNsId ? '暂无配置项，点击「添加配置」创建' : '请选择命名空间'}</td></tr>
+              )}
+            </tbody>
+          </table>
+        </div>
+      </div>
+    </div>
+  );
+}
+
+/* =========================================================================
+ * 灰度规则
+ * ========================================================================= */
+function grayTargetText(rule) {
+  if (rule.ruleType === 'ip') return (rule.ruleValue?.ips || []).join(', ');
+  if (rule.ruleType === 'instance') return (rule.ruleValue?.instances || []).join(', ');
+  return `${rule.ruleValue?.percentage ?? 0}% · salt=${rule.ruleValue?.salt || '-'}`;
+}
+
+function GrayRuleModal({ rule, scope, onClose, onSubmit }) {
+  const [form, setForm] = useState(() => ({
+    ruleType: rule?.ruleType || 'instance',
+    targets: rule ? grayTargetText(rule).replace(/% · salt=.*$/, '') : '',
+    salt: rule?.ruleValue?.salt || 'configcenter',
+    overrides: rule ? Object.entries(rule.overrides || {}).map(([key, value]) => `${key}=${value}`).join('\n') : '',
+    priority: rule?.priority ?? 0,
+    enabled: rule?.enabled ?? true,
+    desc: rule?.desc || '',
+  }));
+  const [error, setError] = useState('');
+
+  function submit(e) {
+    e.preventDefault();
+    try {
+      const overrides = {};
+      form.overrides.split('\n').map((line) => line.trim()).filter(Boolean).forEach((line) => {
+        const split = line.indexOf('=');
+        if (split < 1) throw new Error(`覆盖项格式错误：${line}`);
+        overrides[line.slice(0, split).trim()] = line.slice(split + 1);
+      });
+      if (!Object.keys(overrides).length) throw new Error('至少填写一个 key=value 覆盖项');
+      const values = form.targets.split(',').map((value) => value.trim()).filter(Boolean);
+      let ruleValue;
+      if (form.ruleType === 'ip') ruleValue = { ips: values };
+      else if (form.ruleType === 'instance') ruleValue = { instances: values };
+      else ruleValue = { percentage: Number(form.targets), salt: form.salt.trim() };
+      if (form.ruleType !== 'percentage' && values.length === 0) throw new Error('匹配目标不能为空');
+      onSubmit({
+        ...scope,
+        ruleType: form.ruleType,
+        ruleValue,
+        overrides,
+        priority: Number(form.priority),
+        enabled: form.enabled,
+        desc: form.desc.trim(),
+      });
+    } catch (err) {
+      setError(err.message);
+    }
+  }
+
+  const set = (key, value) => setForm((current) => ({ ...current, [key]: value }));
+  return (
+    <div className="fixed inset-0 z-50 flex items-center justify-center bg-slate-900/40 backdrop-blur-sm p-4" onClick={onClose}>
+      <form onSubmit={submit} onClick={(e) => e.stopPropagation()} className="bg-white rounded-xl shadow-xl w-full max-w-lg overflow-hidden">
+        <div className="px-5 py-4 border-b border-slate-100 flex items-center justify-between">
+          <div><h3 className="text-sm font-semibold text-slate-800">{rule ? '编辑灰度规则' : '新建灰度规则'}</h3><p className="text-xs text-slate-400 mt-0.5">高优先级规则最后覆盖低优先级规则</p></div>
+          <button type="button" onClick={onClose} className="text-slate-400 hover:text-slate-600"><X size={18} /></button>
+        </div>
+        <div className="p-5 space-y-3">
+          <div className="grid grid-cols-2 gap-3">
+            <Field label="匹配类型" required>
+              <select value={form.ruleType} onChange={(e) => set('ruleType', e.target.value)} className={inputCls()}>
+                <option value="instance">实例 ID</option><option value="ip">IP / CIDR</option><option value="percentage">稳定百分比</option>
+              </select>
+            </Field>
+            <Field label="优先级"><input type="number" value={form.priority} onChange={(e) => set('priority', e.target.value)} className={inputCls()} /></Field>
+          </div>
+          <Field label={form.ruleType === 'percentage' ? '百分比（0–100）' : form.ruleType === 'ip' ? 'IP / CIDR（逗号分隔）' : '实例 ID（逗号分隔）'} required>
+            <input value={form.targets} onChange={(e) => set('targets', e.target.value)} placeholder={form.ruleType === 'percentage' ? '10' : form.ruleType === 'ip' ? '10.0.0.1, 10.0.1.0/24' : 'order-1, order-2'} className={inputCls()} />
+          </Field>
+          {form.ruleType === 'percentage' && <Field label="哈希盐"><input value={form.salt} onChange={(e) => set('salt', e.target.value)} className={inputCls()} /></Field>}
+          <Field label="配置覆盖（每行 key=value）" required><textarea rows={5} value={form.overrides} onChange={(e) => set('overrides', e.target.value)} placeholder={'feature.checkout=true\nrequest.timeout=2000'} className={`${inputCls()} font-mono`} /></Field>
+          <Field label="说明"><input value={form.desc} onChange={(e) => set('desc', e.target.value)} className={inputCls()} /></Field>
+          <label className="flex items-center gap-2 text-sm text-slate-600"><input type="checkbox" checked={form.enabled} onChange={(e) => set('enabled', e.target.checked)} /> 立即启用</label>
+          {error && <p className="text-xs text-rose-600">{error}</p>}
+        </div>
+        <div className="px-5 py-3 border-t border-slate-100 flex justify-end gap-2 bg-slate-50">
+          <button type="button" onClick={onClose} className="px-3 py-1.5 text-sm rounded-lg text-slate-600 hover:bg-slate-100">取消</button>
+          <button type="submit" className="px-3 py-1.5 text-sm rounded-lg bg-indigo-600 text-white hover:bg-indigo-700">保存规则</button>
+        </div>
+      </form>
+    </div>
+  );
+}
+
+function ScopeSelector({ apps, environments, namespaces, selectedAppId, setSelectedAppId, selectedEnvId, setSelectedEnvId, selectedNsId, setSelectedNsId }) {
+  const appNamespaces = namespaces.filter((item) => item.appId === selectedAppId);
+  return (
+    <div className="bg-white rounded-xl border border-slate-200 p-4 grid md:grid-cols-3 gap-3">
+      <Field label="应用"><select value={selectedAppId} onChange={(e) => setSelectedAppId(e.target.value)} className={inputCls()}>{apps.map((item) => <option key={item.id} value={item.id}>{item.name} ({item.code})</option>)}</select></Field>
+      <Field label="环境"><select value={selectedEnvId} onChange={(e) => setSelectedEnvId(e.target.value)} className={inputCls()}>{[...environments].sort((a, b) => a.order - b.order).map((item) => <option key={item.id} value={item.id}>{item.code} · {item.name}</option>)}</select></Field>
+      <Field label="命名空间"><select value={selectedNsId} onChange={(e) => setSelectedNsId(e.target.value)} className={inputCls()}>{appNamespaces.map((item) => <option key={item.id} value={item.id}>{item.name}</option>)}</select></Field>
+    </div>
+  );
+}
+
+function GrayRulesPage(props) {
+  const { grayRules, onAdd, onEdit, onDelete } = props;
+  return (
+    <div className="space-y-4">
+      <ScopeSelector {...props} />
+      <div className="flex justify-end"><button onClick={onAdd} disabled={!props.selectedNsId} className="flex items-center gap-1.5 px-3 py-2 text-sm rounded-lg bg-indigo-600 text-white hover:bg-indigo-700 disabled:opacity-40"><Plus size={15} /> 新建规则</button></div>
+      <div className="bg-white rounded-xl border border-slate-200 overflow-hidden overflow-x-auto">
+        <table className="w-full text-sm min-w-[820px]">
+          <thead className="bg-slate-50 text-slate-500 text-xs"><tr><th className="text-left font-medium px-4 py-2.5">状态</th><th className="text-left font-medium px-4 py-2.5">类型</th><th className="text-left font-medium px-4 py-2.5">匹配目标</th><th className="text-left font-medium px-4 py-2.5">配置覆盖</th><th className="text-left font-medium px-4 py-2.5">优先级</th><th className="text-right font-medium px-4 py-2.5">操作</th></tr></thead>
+          <tbody className="divide-y divide-slate-100">
+            {grayRules.map((rule) => <tr key={rule.id} className="hover:bg-slate-50/70">
+              <td className="px-4 py-3"><span className={`px-2 py-0.5 rounded text-xs ${rule.enabled ? 'bg-emerald-50 text-emerald-700' : 'bg-slate-100 text-slate-500'}`}>{rule.enabled ? '启用' : '停用'}</span></td>
+              <td className="px-4 py-3 font-mono text-xs text-indigo-600">{rule.ruleType}</td>
+              <td className="px-4 py-3 text-xs text-slate-600 max-w-xs break-all">{grayTargetText(rule)}{rule.desc && <div className="text-slate-400 mt-1">{rule.desc}</div>}</td>
+              <td className="px-4 py-3 font-mono text-xs text-slate-600">{Object.entries(rule.overrides || {}).map(([key, value]) => <div key={key}>{key}={value}</div>)}</td>
+              <td className="px-4 py-3 text-slate-500">{rule.priority}</td>
+              <td className="px-4 py-3"><div className="flex justify-end gap-1"><button onClick={() => onEdit(rule)} className="p-1.5 rounded-md text-slate-400 hover:text-indigo-600 hover:bg-indigo-50"><Pencil size={14} /></button><button onClick={() => onDelete(rule)} className="p-1.5 rounded-md text-slate-400 hover:text-rose-600 hover:bg-rose-50"><Trash2 size={14} /></button></div></td>
+            </tr>)}
+            {grayRules.length === 0 && <tr><td colSpan={6} className="px-4 py-10 text-center text-sm text-slate-400">当前范围暂无灰度规则</td></tr>}
+          </tbody>
+        </table>
+      </div>
+    </div>
+  );
+}
+
+/* =========================================================================
+ * 用户与应用权限
+ * ========================================================================= */
+function UserRoleEditor({ user, apps, notify }) {
+  const [roles, setRoles] = useState([]);
+  const [appId, setAppId] = useState(apps[0]?.id || '');
+  const currentRole = roles.find((item) => String(item.appId) === String(appId))?.role || '';
+  useEffect(() => { api.listUserRoles(user.id).then(setRoles).catch((err) => notify(err.message, 'danger')); }, [user.id]); // eslint-disable-line react-hooks/exhaustive-deps
+  useEffect(() => { if (!apps.find((item) => item.id === appId)) setAppId(apps[0]?.id || ''); }, [apps]); // eslint-disable-line react-hooks/exhaustive-deps
+  async function change(role) {
+    try {
+      if (role) await api.setUserRole(user.id, appId, role);
+      else await api.deleteUserRole(user.id, appId);
+      setRoles(await api.listUserRoles(user.id));
+      notify('应用权限已更新');
+    } catch (err) { notify(err.message, 'danger'); }
+  }
+  if (user.isAdmin) return <span className="inline-flex items-center gap-1 text-xs text-indigo-600"><ShieldCheck size={14} /> 全局管理员</span>;
+  return <div className="flex items-center gap-2"><select value={appId} onChange={(e) => setAppId(e.target.value)} className="px-2 py-1.5 text-xs rounded border border-slate-200">{apps.map((item) => <option key={item.id} value={item.id}>{item.code}</option>)}</select><select value={currentRole} onChange={(e) => change(e.target.value)} disabled={!appId} className="px-2 py-1.5 text-xs rounded border border-slate-200"><option value="">无权限</option><option value="viewer">viewer</option><option value="app-owner">app-owner</option></select></div>;
+}
+
+function CreateUserModal({ onClose, onCreated }) {
+  const [form, setForm] = useState({ username: '', displayName: '', password: '', isAdmin: false });
+  const [error, setError] = useState('');
+  async function submit(e) {
+    e.preventDefault();
+    try { await onCreated(form); } catch (err) { setError(err.message); }
+  }
+  const set = (key, value) => setForm((current) => ({ ...current, [key]: value }));
+  return <div className="fixed inset-0 z-50 flex items-center justify-center bg-slate-900/40 backdrop-blur-sm p-4" onClick={onClose}><form onSubmit={submit} onClick={(e) => e.stopPropagation()} className="bg-white rounded-xl shadow-xl w-full max-w-md overflow-hidden"><div className="px-5 py-4 border-b border-slate-100 flex justify-between"><h3 className="text-sm font-semibold">创建用户</h3><button type="button" onClick={onClose}><X size={18} /></button></div><div className="p-5 space-y-3"><Field label="用户名" required><input required value={form.username} onChange={(e) => set('username', e.target.value)} className={inputCls()} /></Field><Field label="显示名称" required><input required value={form.displayName} onChange={(e) => set('displayName', e.target.value)} className={inputCls()} /></Field><Field label="初始密码（至少 12 位）" required><input required minLength={12} type="password" value={form.password} onChange={(e) => set('password', e.target.value)} className={inputCls()} /></Field><label className="flex items-center gap-2 text-sm text-slate-600"><input type="checkbox" checked={form.isAdmin} onChange={(e) => set('isAdmin', e.target.checked)} /> 全局管理员</label>{error && <p className="text-xs text-rose-600">{error}</p>}</div><div className="px-5 py-3 bg-slate-50 flex justify-end gap-2"><button type="button" onClick={onClose} className="px-3 py-1.5 text-sm text-slate-600">取消</button><button className="px-3 py-1.5 text-sm rounded-lg bg-indigo-600 text-white">创建</button></div></form></div>;
+}
+
+function UsersPage({ users, apps, notify, onCreate }) {
+  return <div className="space-y-4"><div className="flex justify-end"><button onClick={onCreate} className="flex items-center gap-1.5 px-3 py-2 text-sm rounded-lg bg-indigo-600 text-white hover:bg-indigo-700"><Plus size={15} /> 创建用户</button></div><div className="bg-white rounded-xl border border-slate-200 overflow-hidden overflow-x-auto"><table className="w-full text-sm min-w-[720px]"><thead className="bg-slate-50 text-xs text-slate-500"><tr><th className="text-left font-medium px-4 py-2.5">用户名</th><th className="text-left font-medium px-4 py-2.5">显示名称</th><th className="text-left font-medium px-4 py-2.5">状态</th><th className="text-left font-medium px-4 py-2.5">应用角色</th></tr></thead><tbody className="divide-y divide-slate-100">{users.map((user) => <tr key={user.id}><td className="px-4 py-3 font-mono text-xs">{user.username}</td><td className="px-4 py-3">{user.displayName}</td><td className="px-4 py-3"><span className={`text-xs ${user.disabled ? 'text-rose-600' : 'text-emerald-600'}`}>{user.disabled ? '已禁用' : '正常'}</span></td><td className="px-4 py-3"><UserRoleEditor user={user} apps={apps} notify={notify} /></td></tr>)}{users.length === 0 && <tr><td colSpan={4} className="px-4 py-10 text-center text-slate-400">暂无用户</td></tr>}</tbody></table></div></div>;
+}
+
+/* =========================================================================
+ * 主组件
+ * ========================================================================= */
+export default function ConfigCenter() {
+  const [nav, setNav] = useState('configs');
+  const [environments, setEnvironments] = useState([]);
+  const [apps, setApps] = useState([]);
+  const [namespaces, setNamespaces] = useState([]);
+  const [configs, setConfigs] = useState([]);
+  const [releases, setReleases] = useState([]);
+  const [grayRules, setGrayRules] = useState([]);
+  const [users, setUsers] = useState([]);
+  const [identity, setIdentity] = useState(null);
+
+  const [appSearch, setAppSearch] = useState('');
+  const [nsSearch, setNsSearch] = useState('');
+  const [nsFilterApp, setNsFilterApp] = useState('all');
+  const [configSearch, setConfigSearch] = useState('');
+
+  const [selectedAppId, setSelectedAppId] = useState('');
+  const [selectedEnvId, setSelectedEnvId] = useState('');
+  const [selectedNsId, setSelectedNsId] = useState('');
+
+  const [modal, setModal] = useState(null);
+  const [confirmState, setConfirmState] = useState(null);
+  const [toast, setToast] = useState(null);
+  const [publishOpen, setPublishOpen] = useState(false);
+  const [historyOpen, setHistoryOpen] = useState(false);
+  const [grayModal, setGrayModal] = useState(null);
+  const [createUserOpen, setCreateUserOpen] = useState(false);
+  const [releaseComment, setReleaseComment] = useState('');
+  const [loading, setLoading] = useState(true);
+  const [authRequired, setAuthRequired] = useState(false);
+
+  useEffect(() => {
+    let active = true;
+    api.bootstrap()
+      .then((data) => {
+        if (!active) return;
+        setApps(data.apps);
+        setEnvironments(data.environments);
+        setNamespaces(data.namespaces);
+        setIdentity(data.identity);
+      })
+      .catch((err) => {
+        if (!active) return;
+        if (err.status === 401) setAuthRequired(true);
+        else notify(err.message, 'danger');
+      })
+      .finally(() => active && setLoading(false));
+    return () => { active = false; };
+  }, []);
+
+  useEffect(() => api.onUnauthorized(() => setAuthRequired(true)), []);
+
+  useEffect(() => {
+    if (!selectedAppId || !selectedNsId || !selectedEnvId) {
+      setConfigs([]);
+      setReleases([]);
+      setGrayRules([]);
+      return undefined;
+    }
+    let active = true;
+    Promise.all([
+      api.listConfigItems(selectedAppId, selectedNsId, selectedEnvId),
+      api.listReleases(selectedAppId, selectedNsId, selectedEnvId),
+      api.listGrayRules(selectedAppId, selectedNsId, selectedEnvId),
+    ]).then(([nextConfigs, nextReleases, nextGrayRules]) => {
+      if (!active) return;
+      setConfigs(nextConfigs);
+      setReleases(nextReleases);
+      setGrayRules(nextGrayRules);
+    }).catch((err) => active && notify(err.message, 'danger'));
+    return () => { active = false; };
+  }, [selectedAppId, selectedNsId, selectedEnvId]);
+
+  useEffect(() => {
+    if (nav !== 'users' || !identity?.user?.isAdmin) return;
+    api.listUsers().then(setUsers).catch((err) => notify(err.message, 'danger'));
+  }, [nav, identity?.user?.isAdmin]); // eslint-disable-line react-hooks/exhaustive-deps
+
+  // 保持所选应用 / 环境 / 命名空间在数据变化后依然有效
+  useEffect(() => {
+    if (!apps.length) setSelectedAppId('');
+    else if (!apps.find((a) => a.id === selectedAppId)) setSelectedAppId(apps[0].id);
+  }, [apps]); // eslint-disable-line react-hooks/exhaustive-deps
+
+  useEffect(() => {
+    if (!environments.length) setSelectedEnvId('');
+    else if (!environments.find((e) => e.id === selectedEnvId)) setSelectedEnvId([...environments].sort((a, b) => a.order - b.order)[0].id);
+  }, [environments]); // eslint-disable-line react-hooks/exhaustive-deps
+
+  useEffect(() => {
+    const appNs = namespaces.filter((n) => n.appId === selectedAppId);
+    if (!appNs.find((n) => n.id === selectedNsId)) {
+      setSelectedNsId(appNs[0]?.id || '');
+    }
+  }, [selectedAppId, namespaces]); // eslint-disable-line react-hooks/exhaustive-deps
+
+  function notify(msg, tone) {
+    setToast({ msg, tone });
+    setTimeout(() => setToast(null), 2600);
+  }
+
+  async function reloadCatalog() {
+    const data = await api.bootstrap();
+    setApps(data.apps);
+    setEnvironments(data.environments);
+    setNamespaces(data.namespaces);
+    setIdentity(data.identity);
+  }
+
+  async function login(username, password) {
+    const result = await api.login(username, password);
+    api.setToken(result.token);
+    setLoading(true);
+    try {
+      await reloadCatalog();
+      setAuthRequired(false);
+    } catch (err) {
+      api.setToken('');
+      throw err;
+    } finally {
+      setLoading(false);
+    }
+  }
+
+  async function reloadScope() {
+    if (!selectedAppId || !selectedNsId || !selectedEnvId) return;
+    const [nextConfigs, nextReleases, nextGrayRules] = await Promise.all([
+      api.listConfigItems(selectedAppId, selectedNsId, selectedEnvId),
+      api.listReleases(selectedAppId, selectedNsId, selectedEnvId),
+      api.listGrayRules(selectedAppId, selectedNsId, selectedEnvId),
+    ]);
+    setConfigs(nextConfigs);
+    setReleases(nextReleases);
+    setGrayRules(nextGrayRules);
+  }
+
+  function logout() {
+    api.setToken('');
+    setIdentity(null);
+    setAuthRequired(true);
+  }
+
+  /* ---------- 应用 CRUD ---------- */
+  function openAddApp() { setModal({ entityType: 'app', mode: 'add', data: {} }); }
+  function openEditApp(a) { setModal({ entityType: 'app', mode: 'edit', data: { ...a } }); }
+  function deleteApp(a) {
+    setConfirmState({
+      title: '删除应用',
+      message: `删除应用「${a.name}」将同时删除其下所有命名空间与配置项，此操作不可撤销。`,
+      onConfirm: async () => {
+        try {
+          await api.deleteApplication(a.id);
+          await reloadCatalog();
+          setConfirmState(null);
+          notify('应用已删除', 'danger');
+        } catch (err) {
+          notify(err.message, 'danger');
+        }
+      },
+    });
+  }
+
+  /* ---------- 命名空间 CRUD ---------- */
+  function openAddNamespace() { setModal({ entityType: 'namespace', mode: 'add', data: { appId: selectedAppId || apps[0]?.id, type: 'properties' } }); }
+  function openEditNamespace(n) { setModal({ entityType: 'namespace', mode: 'edit', data: { ...n } }); }
+  function deleteNamespace(n) {
+    setConfirmState({
+      title: '删除命名空间',
+      message: `删除命名空间「${n.name}」将同时删除其下所有配置项，此操作不可撤销。`,
+      onConfirm: async () => {
+        try {
+          await api.deleteNamespace(n.id);
+          await reloadCatalog();
+          setConfirmState(null);
+          notify('命名空间已删除', 'danger');
+        } catch (err) {
+          notify(err.message, 'danger');
+        }
+      },
+    });
+  }
+
+  /* ---------- 环境 CRUD ---------- */
+  function openAddEnvironment() { setModal({ entityType: 'environment', mode: 'add', data: { order: environments.length + 1 } }); }
+  function openEditEnvironment(env) { setModal({ entityType: 'environment', mode: 'edit', data: { ...env } }); }
+  function deleteEnvironment(env) {
+    setConfirmState({
+      title: '删除环境',
+      message: `删除环境「${env.name}」将同时删除该环境下的所有配置项与发布记录，此操作不可撤销。`,
+      onConfirm: async () => {
+        try {
+          await api.deleteEnvironment(env.id);
+          await reloadCatalog();
+          setConfirmState(null);
+          notify('环境已删除', 'danger');
+        } catch (err) {
+          notify(err.message, 'danger');
+        }
+      },
+    });
+  }
+
+  /* ---------- 配置项 CRUD ---------- */
+  function openAddConfig() { if (!selectedNsId) return; setModal({ entityType: 'config', mode: 'add', data: {} }); }
+  function openEditConfig(c) { setModal({ entityType: 'config', mode: 'edit', data: { ...c } }); }
+  async function toggleDeleteConfig(c) {
+    try {
+      if (c.pendingDelete) await api.restoreConfigItem(c.id);
+      else await api.deleteConfigItem(c.id);
+      await reloadScope();
+    } catch (err) {
+      notify(err.message, 'danger');
+    }
+  }
+
+  async function saveGrayRule(input) {
+    try {
+      if (grayModal?.rule) await api.updateGrayRule(grayModal.rule.id, input);
+      else await api.createGrayRule(input);
+      setGrayModal(null);
+      await reloadScope();
+      notify(grayModal?.rule ? '灰度规则已更新' : '灰度规则已创建');
+    } catch (err) { notify(err.message, 'danger'); }
+  }
+
+  function deleteGrayRule(rule) {
+    setConfirmState({
+      title: '删除灰度规则',
+      message: `确定删除规则「${rule.desc || `#${rule.id}`}」吗？匹配该规则的实例将立即恢复基础配置。`,
+      onConfirm: async () => {
+        try { await api.deleteGrayRule(rule.id); setConfirmState(null); await reloadScope(); notify('灰度规则已删除', 'danger'); }
+        catch (err) { notify(err.message, 'danger'); }
+      },
+    });
+  }
+
+  async function createUser(input) {
+    const created = await api.createUser(input);
+    setUsers((current) => [...current, created]);
+    setCreateUserOpen(false);
+    notify('用户创建成功');
+  }
+
+  /* ---------- 弹窗提交统一分发 ---------- */
+  async function handleModalSubmit(form) {
+    if (!modal) return;
+    const { entityType, mode } = modal;
+    try {
+      if (entityType === 'app') {
+        if (!form.code || !form.name) { notify('请填写应用 ID 与名称', 'danger'); return; }
+        if (mode === 'add') await api.createApplication(form);
+        else await api.updateApplication(form.id, form);
+        await reloadCatalog();
+        notify(mode === 'add' ? '应用创建成功' : '应用已更新');
+      }
+
+      if (entityType === 'namespace') {
+        if (!form.appId || !form.name) { notify('请选择应用并填写命名空间名称', 'danger'); return; }
+        if (mode === 'add') await api.createNamespace(form);
+        else await api.updateNamespace(form.id, form);
+        await reloadCatalog();
+        notify(mode === 'add' ? '命名空间创建成功' : '命名空间已更新');
+      }
+
+      if (entityType === 'environment') {
+        if (!form.code || !form.name) { notify('请填写环境编码与名称', 'danger'); return; }
+        if (mode === 'add') await api.createEnvironment(form);
+        else await api.updateEnvironment(form.id, form);
+        await reloadCatalog();
+        notify(mode === 'add' ? '环境创建成功' : '环境已更新');
+      }
+
+      if (entityType === 'config') {
+        if (!form.value || (mode === 'add' && !form.key)) { notify('请填写 Key 和 Value', 'danger'); return; }
+        if (mode === 'add') {
+          await api.createConfigItem({ ...form, appId: selectedAppId, nsId: selectedNsId, envId: selectedEnvId });
+        } else {
+          await api.updateConfigItem(form.id, form);
+        }
+        await reloadScope();
+        notify(mode === 'add' ? '配置项已添加，待发布生效' : '配置项已修改，待发布生效');
+      }
+      setModal(null);
+    } catch (err) {
+      notify(err.message, 'danger');
+    }
+  }
+
+  /* ---------- 当前选中范围 ---------- */
+  const scopeConfigs = configs.filter((c) => c.appId === selectedAppId && c.nsId === selectedNsId && c.envId === selectedEnvId);
+  const scopeReleases = releases.filter((r) => r.appId === selectedAppId && r.nsId === selectedNsId && r.envId === selectedEnvId);
+  const selectedApp = apps.find((a) => a.id === selectedAppId);
+  const selectedNs = namespaces.find((n) => n.id === selectedNsId);
+  const selectedEnv = environments.find((e) => e.id === selectedEnvId);
+
+  /* ---------- 发布 ---------- */
+  async function confirmPublish() {
+    const pending = scopeConfigs.filter(isPendingItem);
+    if (pending.length === 0) return;
+    try {
+      const release = await api.publish({ appId: selectedAppId, nsId: selectedNsId, envId: selectedEnvId, comment: releaseComment });
+      setPublishOpen(false);
+      setReleaseComment('');
+      await reloadScope();
+      notify(`发布 v${release.version} 已提交，正在下发到运行时`);
+      window.setTimeout(() => reloadScope().catch(() => {}), 1000);
+    } catch (err) {
+      notify(err.message, 'danger');
+    }
+  }
+
+  /* ---------- 回滚 ---------- */
+  function rollbackTo(release) {
+    setConfirmState({
+      title: '回滚确认',
+      message: `确定要回滚到 v${release.version} 吗？当前配置将被覆盖，回滚会生成一条新的发布记录。`,
+      confirmLabel: '确认回滚',
+      onConfirm: async () => {
+        try {
+          const newRelease = await api.rollback({
+            appId: release.appId,
+            nsId: release.nsId,
+            envId: release.envId,
+            targetVersion: release.version,
+          });
+          await reloadScope();
+          setConfirmState(null);
+          setHistoryOpen(false);
+          notify(`回滚版本 v${newRelease.version} 已提交`);
+          window.setTimeout(() => reloadScope().catch(() => {}), 1000);
+        } catch (err) {
+          notify(err.message, 'danger');
+        }
+      },
+    });
+  }
+
+  if (authRequired) return <LoginPage onLogin={login} />;
+
+  return (
+    <div className="h-screen bg-slate-50 font-sans text-slate-900 flex overflow-hidden">
+      <Sidebar nav={nav} setNav={setNav} identity={identity} onLogout={logout} />
+      <div className="flex-1 flex flex-col min-w-0">
+        <TopBar nav={nav} />
+        <main className="flex-1 overflow-auto p-6">
+          {loading && <div className="h-full flex items-center justify-center text-sm text-slate-400">正在连接配置中心…</div>}
+          {!loading && nav === 'apps' && (
+            <AppsPage apps={apps} namespaces={namespaces} search={appSearch} setSearch={setAppSearch} onAdd={openAddApp} onEdit={openEditApp} onDelete={deleteApp} />
+          )}
+          {!loading && nav === 'namespaces' && (
+            <NamespacesPage namespaces={namespaces} apps={apps} search={nsSearch} setSearch={setNsSearch} filterAppId={nsFilterApp} setFilterAppId={setNsFilterApp} onAdd={openAddNamespace} onEdit={openEditNamespace} onDelete={deleteNamespace} />
+          )}
+          {!loading && nav === 'environments' && (
+            <EnvironmentsPage environments={environments} onAdd={openAddEnvironment} onEdit={openEditEnvironment} onDelete={deleteEnvironment} />
+          )}
+          {!loading && nav === 'configs' && (
+            <ConfigsPage
+              apps={apps} environments={environments} namespaces={namespaces} configs={configs}
+              selectedAppId={selectedAppId} setSelectedAppId={setSelectedAppId}
+              selectedEnvId={selectedEnvId} setSelectedEnvId={setSelectedEnvId}
+              selectedNsId={selectedNsId} setSelectedNsId={setSelectedNsId}
+              search={configSearch} setSearch={setConfigSearch}
+              onAddConfig={openAddConfig} onEditConfig={openEditConfig} onToggleDelete={toggleDeleteConfig}
+              onOpenPublish={() => setPublishOpen(true)} onOpenHistory={() => setHistoryOpen(true)}
+            />
+          )}
+          {!loading && nav === 'gray' && (
+            <GrayRulesPage
+              apps={apps} environments={environments} namespaces={namespaces} grayRules={grayRules}
+              selectedAppId={selectedAppId} setSelectedAppId={setSelectedAppId}
+              selectedEnvId={selectedEnvId} setSelectedEnvId={setSelectedEnvId}
+              selectedNsId={selectedNsId} setSelectedNsId={setSelectedNsId}
+              onAdd={() => setGrayModal({ rule: null })} onEdit={(rule) => setGrayModal({ rule })} onDelete={deleteGrayRule}
+            />
+          )}
+          {!loading && nav === 'users' && identity?.user?.isAdmin && (
+            <UsersPage users={users} apps={apps} notify={notify} onCreate={() => setCreateUserOpen(true)} />
+          )}
+        </main>
+      </div>
+
+      {modal && <EntityModal modal={modal} apps={apps} onClose={() => setModal(null)} onSubmit={handleModalSubmit} />}
+      {confirmState && <ConfirmDialog confirm={confirmState} onCancel={() => setConfirmState(null)} />}
+      {toast && <Toast toast={toast} />}
+      {publishOpen && (
+        <PublishModal
+          scopeConfigs={scopeConfigs}
+          appName={selectedApp?.name} nsName={selectedNs?.name} envCode={selectedEnv?.code}
+          comment={releaseComment} setComment={setReleaseComment}
+          onCancel={() => { setPublishOpen(false); setReleaseComment(''); }}
+          onConfirm={confirmPublish}
+        />
+      )}
+      {historyOpen && (
+        <HistoryModal
+          releases={scopeReleases}
+          appName={selectedApp?.name} nsName={selectedNs?.name} envCode={selectedEnv?.code}
+          onClose={() => setHistoryOpen(false)} onRollback={rollbackTo}
+        />
+      )}
+      {grayModal && (
+        <GrayRuleModal
+          rule={grayModal.rule}
+          scope={{ appId: selectedAppId, nsId: selectedNsId, envId: selectedEnvId }}
+          onClose={() => setGrayModal(null)} onSubmit={saveGrayRule}
+        />
+      )}
+      {createUserOpen && <CreateUserModal onClose={() => setCreateUserOpen(false)} onCreated={createUser} />}
+    </div>
+  );
+}
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..94cdf42
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,14 @@
+FROM golang:1.24-alpine AS build
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+COPY cmd ./cmd
+COPY internal ./internal
+RUN CGO_ENABLED=0 go build -buildvcs=false -trimpath -ldflags="-s -w" -o /out/configcenter ./cmd/server
+
+FROM alpine:3.21
+RUN apk add --no-cache ca-certificates && adduser -D -u 10001 configcenter
+USER configcenter
+COPY --from=build /out/configcenter /usr/local/bin/configcenter
+EXPOSE 8080
+ENTRYPOINT ["configcenter"]
diff --git a/Makefile b/Makefile
new file mode 100644
index 0000000..d1eff64
--- /dev/null
+++ b/Makefile
@@ -0,0 +1,29 @@
+.PHONY: dev test build web-install web-build compose-up compose-down integration-smoke loadtest
+
+dev:
+	go run ./cmd/server
+
+test:
+	GOCACHE=/tmp/configcenter-go-cache go test ./...
+
+build:
+	mkdir -p bin
+	GOCACHE=/tmp/configcenter-go-cache go build -buildvcs=false -trimpath -o bin/configcenter ./cmd/server
+
+web-install:
+	npm --prefix web install
+
+web-build:
+	npm --prefix web run build
+
+compose-up:
+	docker compose up --build
+
+compose-down:
+	docker compose down
+
+integration-smoke:
+	sh scripts/integration-smoke.sh
+
+loadtest:
+	GOCACHE=/tmp/configcenter-go-cache go run ./cmd/loadtest -duration=30s -concurrency=32
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..313d6d3
--- /dev/null
+++ b/README.md
@@ -0,0 +1,208 @@
+# Config Center
+
+一个按 `config-center-etcd-implementation.md` 落地的自建配置中心。PostgreSQL 保存编辑态、版本和审计记录；发布事务写入 release 与 outbox；worker 再将完整 namespace 快照原子下发到 etcd。Web Console 已接入真实 API，不再使用浏览器内存数据。
+
+## 已实现
+
+- 应用、环境、命名空间、配置项 CRUD；
+- 草稿/已发布值分离，新增、修改、待删除状态与发布 diff；
+- PostgreSQL 事务化发布，基于 advisory lock 的并发版本分配；
+- Outbox claim、租约恢复、指数退避、最大重试和 release 状态回写；
+- etcd 完整快照 + `__meta` 同事务写入；
+- 运行时配置读取与 SSE Watch，服务端同 key Watch 扇出；
+- 发布历史和“生成新版本”的可追溯回滚；
+- 审计日志查询；
+- 可选 JWT 登录、bcrypt 密码、全局管理员与应用级 `viewer` / `app-owner` RBAC；
+- IP/CIDR、实例 ID、稳定百分比三类灰度规则，支持优先级覆盖；
+- Go/Python SDK，支持自动重连、全量替换和本地文件缓存兜底；
+- React Web Console（含登录、灰度、用户授权页面）、Docker Compose 与本地内存开发模式；
+- Prometheus 指标与告警规则、三副本服务/三节点 etcd Kubernetes 清单、SLO 压测工具。
+
+## 快速启动
+
+不安装 PostgreSQL/etcd 也可以启动。未设置连接信息时，服务会使用带演示数据的内存控制面和内存运行时：
+
+```bash
+make dev
+```
+
+另开终端启动 Web Console：
+
+```bash
+make web-install
+npm --prefix web run dev
+```
+
+浏览器访问 `http://localhost:5173`。API 默认监听 `http://localhost:8080`。
+
+完整依赖环境：
+
+```bash
+docker compose up --build
+```
+
+Compose 会启动 PostgreSQL、etcd、Redis、Config Server 和 Web Console。打开 `http://localhost:5173`。PostgreSQL migration 会在服务启动时幂等执行。
+
+启用 Prometheus（`http://localhost:9090`）：
+
+```bash
+docker compose --profile monitoring up --build
+```
+
+## 配置
+
+| 环境变量 | 默认值 | 说明 |
+|---|---:|---|
+| `HTTP_ADDR` | `:8080` | HTTP 监听地址 |
+| `DATABASE_URL` | 空 | 为空时使用内存控制面 |
+| `ETCD_ENDPOINTS` | 空 | 逗号分隔；为空时使用内存运行时 |
+| `ETCD_DIAL_TIMEOUT` | `5s` | etcd 连接超时 |
+| `OUTBOX_INTERVAL` | `500ms` | outbox 扫描周期 |
+| `OUTBOX_BATCH_SIZE` | `50` | 单次 claim 数量 |
+| `OUTBOX_MAX_RETRY` | `12` | 下发失败最大重试次数 |
+| `CORS_ALLOWED_ORIGINS` | `http://localhost:5173` | 允许的 Web Origin，逗号分隔 |
+| `AUTH_ENABLED` | `false` | 是否启用 JWT 登录与 RBAC |
+| `JWT_SECRET` | 空 | HS256 密钥；启用认证时至少 32 个字符 |
+| `JWT_TTL` | `8h` | 登录令牌有效期 |
+| `BOOTSTRAP_ADMIN_USERNAME` | `admin` | 首次启动时幂等创建的管理员用户名 |
+| `BOOTSTRAP_ADMIN_PASSWORD` | 空 | 启用认证时必填，至少 12 个字符 |
+| `BOOTSTRAP_ADMIN_DISPLAY_NAME` | `Administrator` | 初始管理员显示名称 |
+
+可复制 `.env.example` 后按部署环境调整。认证启用后，除健康检查、登录和 `/metrics` 外的接口都要求 `Authorization: Bearer <token>`。初始管理员只会在不存在时创建，不会在重启时覆盖已有密码。生产环境应通过 Secret 管理数据库密码、JWT 密钥和初始密码，并启用 PostgreSQL/etcd TLS。
+
+## API
+
+管理面响应统一为 `{ "data": ... }`，错误统一为 `{ "error": { "code", "message" } }`。
+
+| 方法 | 路径 | 说明 |
+|---|---|---|
+| `GET/POST` | `/v1/applications` | 应用列表/创建 |
+| `PUT/DELETE` | `/v1/applications/{id}` | 应用更新/删除 |
+| `GET/POST` | `/v1/environments` | 环境列表/创建 |
+| `GET/POST` | `/v1/namespaces` | 命名空间列表/创建 |
+| `GET/POST` | `/v1/config-items` | 配置项列表/创建 |
+| `PUT/DELETE` | `/v1/config-items/{id}` | 修改/标记待删除 |
+| `POST` | `/v1/config-items/{id}/restore` | 撤销待删除 |
+| `POST` | `/v1/publish` | 创建发布版本，返回 `202` |
+| `GET` | `/v1/releases?appId=&nsId=&envId=` | 发布历史与下发状态 |
+| `POST` | `/v1/rollback` | 回滚并生成新版本 |
+| `GET` | `/v1/audit-logs` | 审计日志 |
+| `POST` | `/v1/auth/login` | 用户登录并签发 JWT |
+| `GET` | `/v1/me` | 当前用户与应用角色 |
+| `GET/POST` | `/v1/users` | 用户列表/创建（管理员） |
+| `GET/PUT/DELETE` | `/v1/users/{id}/roles[/{appId}]` | 应用角色管理（管理员） |
+| `GET/POST` | `/v1/gray-rules` | 当前范围灰度规则列表/创建 |
+| `PUT/DELETE` | `/v1/gray-rules/{id}` | 灰度规则更新/删除 |
+| `GET` | `/v1/config?env=&app=&namespace=&ip=&instance=` | 读取运行时快照并匹配灰度规则 |
+| `GET` | `/v1/watch?env=&app=&namespace=&ip=&instance=` | SSE 全量同步与更新事件 |
+| `GET` | `/metrics` | Prometheus 指标 |
+
+认证关闭时服务以开发管理员身份运行，并可用 `X-User` 记录操作者；认证开启时操作者来自 JWT，客户端不能通过请求头伪造。`viewer` 可以读取应用配置，`app-owner` 还可以维护命名空间、配置、发布、回滚和灰度规则，全局管理员可管理应用、环境、审计和用户授权。
+
+### 灰度匹配
+
+`ip` 规则接受精确 IP 或 CIDR；`instance` 规则接受实例 ID 列表；`percentage` 使用 salt 与实例 ID（无实例时使用 IP）做稳定哈希，同一实例不会随机漂移。多条规则命中时按优先级从低到高覆盖，并在响应的 `grayRuleIds` 中返回命中规则。
+
+### 发布示例
+
+```bash
+curl -X POST http://localhost:8080/v1/publish \
+  -H 'Content-Type: application/json' \
+  -H 'X-User: alice' \
+  -d '{"appId":1,"nsId":1,"envId":1,"comment":"enable feature"}'
+```
+
+数据库事务提交后返回 `pending`；outbox 写入 etcd 后，`GET /v1/releases/{id}` 会变为 `applied` 并带上 `etcdRevision`。
+
+## SDK
+
+Go SDK：
+
+```go
+client, err := configsdk.New(configsdk.Options{
+    BaseURL: "http://localhost:8080",
+    Env: "PROD",
+    App: "order-service",
+    Token: os.Getenv("CONFIGCENTER_TOKEN"),
+    Instance: "order-3",
+    CacheFile: "/var/lib/my-service/configcenter.json",
+})
+if err != nil { /* handle */ }
+
+_ = client.Load(ctx, "application")
+go client.WatchAndSync(ctx, "application")
+port := client.GetInt("application", "server.port", 8080)
+```
+
+Python SDK 位于 `sdk/python`：
+
+```python
+from configcenter import ConfigClient
+
+client = ConfigClient(
+    "http://localhost:8080", "PROD", "order-service", "/tmp/order-config.json",
+    token=os.environ.get("CONFIGCENTER_TOKEN"), instance="order-3",
+)
+client.load("application")
+client.start_background_watch("application")
+timeout = client.get("application", "order.timeout.minutes", "30")
+```
+
+本地缓存采用完整快照和原子 rename；Config Server/etcd 暂时不可用时，进程可以读取上一次成功同步的缓存启动。
+
+## 开发与验证
+
+```bash
+make test
+make build
+make web-build
+docker compose config
+make integration-smoke
+make loadtest
+```
+
+核心端到端测试覆盖：CRUD → 发布事务 → outbox worker → 运行时读取 → 灰度覆盖与指标；单元/HTTP 集成测试还覆盖 JWT 过期与篡改、应用级 RBAC、多版本回滚和 SDK 鉴权/灰度参数。
+
+压测工具默认验证运行时读取的错误率不超过 1%、p95 不超过 200ms，可覆盖目标和阈值：
+
+```bash
+go run ./cmd/loadtest \
+  -base-url=http://127.0.0.1:8080 -env=DEV -app=demo-service -namespace=application \
+  -token="$CONFIGCENTER_TOKEN" -concurrency=64 -duration=60s -max-p95=200ms
+```
+
+## 生产部署
+
+`deploy/kubernetes/configcenter.yaml` 提供三副本无状态 Config Server、三节点 etcd、跨节点调度、PDB、HPA、探针和资源限制。部署前替换镜像与 Origin，并创建密钥：
+
+```bash
+kubectl create namespace configcenter
+kubectl -n configcenter create secret generic configcenter-secrets \
+  --from-literal=DATABASE_URL='postgres://...' \
+  --from-literal=JWT_SECRET='至少32位随机密钥' \
+  --from-literal=BOOTSTRAP_ADMIN_PASSWORD='至少12位初始密码'
+kubectl apply -f deploy/kubernetes/configcenter.yaml
+```
+
+生产 PostgreSQL 应使用托管高可用/主从方案；etcd 应跨故障域部署，定期 snapshot、compact 和 defrag。示例清单使用明文集群内 etcd 地址，生产落地需补充双向 TLS 和只允许 Config Server 访问的网络策略。
+
+## 目录
+
+```text
+cmd/server                 服务入口
+internal/api/httpapi       REST + SSE
+internal/store/postgres    PostgreSQL repository 与 migration
+internal/store/memory      本地开发/测试实现
+internal/runtime/etcd      etcd 快照与 Watch
+internal/outbox            异步下发 worker
+internal/watch             同 key Watch 扇出
+internal/auth              JWT、密码与应用级 RBAC
+internal/gray              灰度规则校验与确定性匹配
+internal/metrics           Prometheus 指标
+cmd/loadtest               运行时读取 SLO 压测
+deploy                     Kubernetes 与监控告警配置
+pkg/sdk/go                 Go SDK
+sdk/python                 Python SDK
+api/proto                  gRPC 契约
+web                        React Web Console
+```
diff --git a/api/proto/configcenter/v1/config.proto b/api/proto/configcenter/v1/config.proto
new file mode 100644
index 0000000..175932d
--- /dev/null
+++ b/api/proto/configcenter/v1/config.proto
@@ -0,0 +1,77 @@
+syntax = "proto3";
+
+package configcenter.v1;
+
+option go_package = "github.com/longpeng/configcenter/pkg/proto/v1;configcenterv1";
+
+message ConfigItem {
+  string key = 1;
+  string value = 2;
+}
+
+message GetConfigRequest {
+  string env = 1;
+  string app = 2;
+  string namespace = 3;
+}
+
+message GetConfigResponse {
+  repeated ConfigItem items = 1;
+  int64 revision = 2;
+  int64 release_version = 3;
+}
+
+message WatchConfigRequest {
+  string env = 1;
+  string app = 2;
+  string namespace = 3;
+  int64 start_revision = 4;
+}
+
+message ConfigEvent {
+  enum EventType {
+    FULL_SYNC = 0;
+    UPDATED = 1;
+  }
+  EventType type = 1;
+  repeated ConfigItem items = 2;
+  int64 revision = 3;
+}
+
+message PublishRequest {
+  int64 env_id = 1;
+  int64 app_id = 2;
+  int64 namespace_id = 3;
+  string comment = 4;
+  string operator = 5;
+}
+
+message PublishResponse {
+  int64 release_id = 1;
+  int64 release_version = 2;
+  string status = 3;
+}
+
+message RollbackRequest {
+  int64 env_id = 1;
+  int64 app_id = 2;
+  int64 namespace_id = 3;
+  int64 target_version = 4;
+  string operator = 5;
+}
+
+message RollbackResponse {
+  int64 release_id = 1;
+  int64 new_release_version = 2;
+  string status = 3;
+}
+
+service ConfigService {
+  rpc GetConfig(GetConfigRequest) returns (GetConfigResponse);
+  rpc WatchConfig(WatchConfigRequest) returns (stream ConfigEvent);
+}
+
+service AdminService {
+  rpc PublishConfig(PublishRequest) returns (PublishResponse);
+  rpc RollbackConfig(RollbackRequest) returns (RollbackResponse);
+}
diff --git a/cmd/loadtest/main.go b/cmd/loadtest/main.go
new file mode 100644
index 0000000..50a6267
--- /dev/null
+++ b/cmd/loadtest/main.go
@@ -0,0 +1,107 @@
+package main
+
+import (
+	"context"
+	"flag"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"os"
+	"sort"
+	"sync"
+	"time"
+)
+
+type result struct {
+	duration time.Duration
+	ok       bool
+}
+
+func main() {
+	baseURL := flag.String("base-url", "http://127.0.0.1:8080", "Config Center base URL")
+	env := flag.String("env", "DEV", "environment code")
+	app := flag.String("app", "demo-service", "application code")
+	namespace := flag.String("namespace", "application", "namespace")
+	token := flag.String("token", "", "optional bearer token")
+	concurrency := flag.Int("concurrency", 32, "concurrent workers")
+	duration := flag.Duration("duration", 30*time.Second, "test duration")
+	maxErrorRate := flag.Float64("max-error-rate", 0.01, "failure threshold")
+	maxP95 := flag.Duration("max-p95", 200*time.Millisecond, "p95 latency threshold")
+	flag.Parse()
+	if *concurrency <= 0 || *duration <= 0 {
+		fmt.Fprintln(os.Stderr, "concurrency and duration must be positive")
+		os.Exit(2)
+	}
+
+	query := url.Values{"env": {*env}, "app": {*app}, "namespace": {*namespace}}
+	endpoint := fmt.Sprintf("%s/v1/config?%s", *baseURL, query.Encode())
+	client := &http.Client{Transport: &http.Transport{MaxIdleConns: *concurrency * 2, MaxIdleConnsPerHost: *concurrency, IdleConnTimeout: 30 * time.Second}, Timeout: 5 * time.Second}
+	ctx, cancel := context.WithTimeout(context.Background(), *duration)
+	defer cancel()
+	results := make(chan result, *concurrency*128)
+	var workers sync.WaitGroup
+
+	for i := 0; i < *concurrency; i++ {
+		workers.Add(1)
+		go func() {
+			defer workers.Done()
+			for ctx.Err() == nil {
+				request, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil)
+				if err != nil {
+					return
+				}
+				if *token != "" {
+					request.Header.Set("Authorization", "Bearer "+*token)
+				}
+				begin := time.Now()
+				response, err := client.Do(request)
+				elapsed := time.Since(begin)
+				if err != nil && ctx.Err() != nil {
+					return
+				}
+				ok := err == nil && response.StatusCode == http.StatusOK
+				if response != nil {
+					_, _ = io.Copy(io.Discard, response.Body)
+					response.Body.Close()
+				}
+				select {
+				case results <- result{duration: elapsed, ok: ok}:
+				case <-ctx.Done():
+					return
+				}
+			}
+		}()
+	}
+	go func() {
+		workers.Wait()
+		close(results)
+	}()
+
+	latencies := make([]time.Duration, 0)
+	failures := 0
+	for item := range results {
+		latencies = append(latencies, item.duration)
+		if !item.ok {
+			failures++
+		}
+	}
+	if len(latencies) == 0 {
+		fmt.Fprintln(os.Stderr, "no requests completed")
+		os.Exit(1)
+	}
+	sort.Slice(latencies, func(i, j int) bool { return latencies[i] < latencies[j] })
+	p50, p95, p99 := percentile(latencies, 0.50), percentile(latencies, 0.95), percentile(latencies, 0.99)
+	errorRate := float64(failures) / float64(len(latencies))
+	qps := float64(len(latencies)) / duration.Seconds()
+	fmt.Printf("requests=%d failures=%d error_rate=%.4f qps=%.1f p50=%s p95=%s p99=%s\n", len(latencies), failures, errorRate, qps, p50, p95, p99)
+	if errorRate > *maxErrorRate || p95 > *maxP95 {
+		fmt.Fprintf(os.Stderr, "SLO failed: error_rate<=%.4f p95<=%s\n", *maxErrorRate, *maxP95)
+		os.Exit(1)
+	}
+}
+
+func percentile(values []time.Duration, quantile float64) time.Duration {
+	index := int(float64(len(values)-1) * quantile)
+	return values[index]
+}
diff --git a/cmd/server/main.go b/cmd/server/main.go
new file mode 100644
index 0000000..33e214c
--- /dev/null
+++ b/cmd/server/main.go
@@ -0,0 +1,121 @@
+package main
+
+import (
+	"context"
+	"flag"
+	"log/slog"
+	"net/http"
+	"os"
+	"os/signal"
+	"syscall"
+	"time"
+
+	"github.com/longpeng/configcenter/internal/api/httpapi"
+	"github.com/longpeng/configcenter/internal/auth"
+	"github.com/longpeng/configcenter/internal/config"
+	"github.com/longpeng/configcenter/internal/metrics"
+	"github.com/longpeng/configcenter/internal/outbox"
+	runtimepkg "github.com/longpeng/configcenter/internal/runtime"
+	etcdstore "github.com/longpeng/configcenter/internal/runtime/etcd"
+	memoryruntime "github.com/longpeng/configcenter/internal/runtime/memory"
+	storepkg "github.com/longpeng/configcenter/internal/store"
+	memory_store "github.com/longpeng/configcenter/internal/store/memory"
+	postgres_store "github.com/longpeng/configcenter/internal/store/postgres"
+	"github.com/longpeng/configcenter/internal/watch"
+)
+
+func main() {
+	migrateOnly := flag.Bool("migrate-only", false, "apply database migrations and exit")
+	flag.Parse()
+
+	logger := slog.New(slog.NewJSONHandler(os.Stdout, &slog.HandlerOptions{Level: slog.LevelInfo}))
+	cfg := config.Load()
+	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
+	defer stop()
+
+	repository, err := openStore(ctx, cfg, logger)
+	if err != nil {
+		logger.Error("open control-plane store", "error", err)
+		os.Exit(1)
+	}
+	defer repository.Close()
+	if *migrateOnly {
+		logger.Info("database migrations applied")
+		return
+	}
+	authorizer, err := auth.New(repository, cfg.AuthEnabled, cfg.JWTSecret, cfg.JWTTTL)
+	if err != nil {
+		logger.Error("initialize authentication", "error", err)
+		os.Exit(1)
+	}
+	if err := authorizer.Bootstrap(ctx, cfg.BootstrapAdminUsername, cfg.BootstrapAdminPassword, cfg.BootstrapAdminDisplayName); err != nil {
+		logger.Error("bootstrap administrator", "error", err)
+		os.Exit(1)
+	}
+
+	runtimeStore, err := openRuntime(cfg, logger)
+	if err != nil {
+		logger.Error("open runtime store", "error", err)
+		os.Exit(1)
+	}
+	defer runtimeStore.Close() //nolint:errcheck
+
+	hub := watch.New(ctx, runtimeStore)
+	collector := metrics.New()
+	worker := outbox.New(repository, runtimeStore, cfg.OutboxInterval, cfg.OutboxBatchSize, cfg.OutboxMaxRetry, collector, logger)
+	go worker.Run(ctx)
+
+	api := httpapi.New(repository, runtimeStore, hub, authorizer, collector, cfg.AllowedOrigins, logger)
+	server := &http.Server{
+		Addr:              cfg.HTTPAddr,
+		Handler:           api.Handler(),
+		ReadHeaderTimeout: 5 * time.Second,
+		ReadTimeout:       15 * time.Second,
+		IdleTimeout:       60 * time.Second,
+	}
+
+	serverErrors := make(chan error, 1)
+	go func() {
+		logger.Info("config center listening", "address", cfg.HTTPAddr)
+		serverErrors <- server.ListenAndServe()
+	}()
+
+	select {
+	case <-ctx.Done():
+		logger.Info("shutting down config center")
+	case err := <-serverErrors:
+		if err != nil && err != http.ErrServerClosed {
+			logger.Error("http server stopped", "error", err)
+		}
+	}
+
+	shutdownCtx, cancel := context.WithTimeout(context.Background(), cfg.ShutdownTimeout)
+	defer cancel()
+	if err := server.Shutdown(shutdownCtx); err != nil {
+		logger.Error("graceful shutdown", "error", err)
+	}
+}
+
+func openStore(ctx context.Context, cfg config.Config, logger *slog.Logger) (storepkg.Store, error) {
+	if cfg.DatabaseURL == "" {
+		logger.Warn("DATABASE_URL is empty; using the in-memory control-plane store")
+		return memory_store.New(true), nil
+	}
+	repository, err := postgres_store.Open(ctx, cfg.DatabaseURL)
+	if err != nil {
+		return nil, err
+	}
+	if err := repository.Migrate(ctx); err != nil {
+		repository.Close()
+		return nil, err
+	}
+	return repository, nil
+}
+
+func openRuntime(cfg config.Config, logger *slog.Logger) (runtimepkg.Store, error) {
+	if len(cfg.EtcdEndpoints) == 0 {
+		logger.Warn("ETCD_ENDPOINTS is empty; using the in-memory runtime store")
+		return memoryruntime.New(), nil
+	}
+	return etcdstore.Open(cfg.EtcdEndpoints, cfg.EtcdDialTimeout)
+}
diff --git a/compose.yaml b/compose.yaml
new file mode 100644
index 0000000..a259028
--- /dev/null
+++ b/compose.yaml
@@ -0,0 +1,97 @@
+services:
+  postgres:
+    image: postgres:16-alpine
+    environment:
+      POSTGRES_DB: configcenter
+      POSTGRES_USER: configcenter
+      POSTGRES_PASSWORD: configcenter
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U configcenter -d configcenter"]
+      interval: 5s
+      timeout: 3s
+      retries: 20
+    volumes:
+      - postgres-data:/var/lib/postgresql/data
+
+  etcd:
+    image: quay.io/coreos/etcd:v3.5.17
+    command:
+      - /usr/local/bin/etcd
+      - --name=etcd-1
+      - --data-dir=/etcd-data
+      - --listen-client-urls=http://0.0.0.0:2379
+      - --advertise-client-urls=http://etcd:2379
+    healthcheck:
+      test: ["CMD", "etcdctl", "endpoint", "health"]
+      interval: 5s
+      timeout: 3s
+      retries: 20
+    volumes:
+      - etcd-data:/etcd-data
+
+  redis:
+    image: redis:7.4-alpine
+    command: ["redis-server", "--appendonly", "yes"]
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 5s
+      timeout: 3s
+      retries: 20
+    volumes:
+      - redis-data:/data
+
+  server:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    environment:
+      HTTP_ADDR: :8080
+      DATABASE_URL: postgres://configcenter:configcenter@postgres:5432/configcenter?sslmode=disable
+      ETCD_ENDPOINTS: http://etcd:2379
+      CORS_ALLOWED_ORIGINS: http://localhost:5173
+      AUTH_ENABLED: ${AUTH_ENABLED:-false}
+      JWT_SECRET: ${JWT_SECRET:-}
+      JWT_TTL: ${JWT_TTL:-8h}
+      BOOTSTRAP_ADMIN_USERNAME: ${BOOTSTRAP_ADMIN_USERNAME:-admin}
+      BOOTSTRAP_ADMIN_PASSWORD: ${BOOTSTRAP_ADMIN_PASSWORD:-}
+      BOOTSTRAP_ADMIN_DISPLAY_NAME: ${BOOTSTRAP_ADMIN_DISPLAY_NAME:-Administrator}
+    depends_on:
+      postgres:
+        condition: service_healthy
+      etcd:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD", "wget", "-q", "-O", "-", "http://127.0.0.1:8080/health/ready"]
+      interval: 5s
+      timeout: 3s
+      retries: 20
+    ports:
+      - "8080:8080"
+
+  web:
+    build:
+      context: .
+      dockerfile: web/Dockerfile
+    depends_on:
+      server:
+        condition: service_healthy
+    ports:
+      - "5173:80"
+
+  prometheus:
+    image: prom/prometheus:v3.2.1
+    profiles: ["monitoring"]
+    command: ["--config.file=/etc/prometheus/prometheus.yml"]
+    volumes:
+      - ./deploy/monitoring/prometheus.yml:/etc/prometheus/prometheus.yml:ro
+      - ./deploy/monitoring/alerts.yml:/etc/prometheus/alerts.yml:ro
+    depends_on:
+      server:
+        condition: service_healthy
+    ports:
+      - "9090:9090"
+
+volumes:
+  postgres-data:
+  etcd-data:
+  redis-data:
diff --git a/config-center-etcd-implementation.md b/config-center-etcd-implementation.md
new file mode 100644
index 0000000..2cd4906
--- /dev/null
+++ b/config-center-etcd-implementation.md
@@ -0,0 +1,506 @@
+# 自建配置中心实现方案（etcd + PostgreSQL + Redis + Go）
+
+对应架构：
+
+```
+                  Web Console
+                       │
+                       ▼
+                Config Server (Go)
+                       │
+        ┌──────────────┼──────────────┐
+        │              │              │
+     PostgreSQL       etcd         Redis
+   配置/版本/RBAC     生效配置       缓存/事件
+   发布记录/审计       Watch
+```
+
+## 一、核心设计原则
+
+**PostgreSQL 是控制面（source of truth），etcd 是数据面（运行时分发）。**
+
+配置的"编辑态"（草稿）永远只存在 PostgreSQL 里；只有点了「发布」，才会把该 namespace 当前生效的完整配置写进 etcd。etcd 里任何时刻只保存"当前生效"的那一份，历史版本、审计、RBAC 全部留在 PG。
+
+这样划分带来两个好处：
+- etcd 数据量可控（etcd 官方建议库大小控制在几个 GB 内，不适合塞历史/审计数据）；
+- 复杂查询（按部门筛选应用、按时间查审计日志）交给关系型数据库，etcd 只做它最擅长的事：强一致 + Watch。
+
+## 二、发布语义与一致性（Outbox 模式）
+
+发布动作要跨两个存储写入，如果直接「先写 PG 再写 etcd」，中间进程崩溃会导致状态不一致（PG 说已发布，etcd 里其实是旧值）。
+
+解决办法：**Outbox 模式**——发布在同一个 PG 事务里写入 `releases` 记录和 `release_outbox` 记录；一个独立的异步 worker 轮询 outbox，把内容幂等地 Put 进 etcd，成功后回写 `etcd_revision` 并标记 `applied`。这样即使 Config Server 中途重启，未完成的发布也能被 worker 续上，不会丢失，也不会重复产生副作用（Put 本身是幂等的）。
+
+```
+发布请求
+   │
+   ▼
+PG 事务：写 releases + release_outbox（DB 提交即成功返回给用户）
+   │
+   ▼
+Outbox Worker（异步、可重试）
+   │
+   ▼
+etcd.Put(key, snapshot)  ──成功──▶ 回写 etcd_revision，release.status = applied
+                          └─失败──▶ retry_count++，下一轮重试
+```
+
+## 三、etcd Key 设计
+
+推荐按 **namespace 整体做一个 blob**，而不是每个 key 单独存一条，理由：一次发布往往同时改多个 key，整体 blob 能保证客户端拿到的永远是"某个版本的完整快照"，不会出现 watch 到一半、配置项之间不一致的中间态。
+
+```
+/config/{env}/{app}/{namespace}        -> JSON: {"server.port":"8080", "log.level":"INFO", ...}
+/config/{env}/{app}/{namespace}/__meta -> JSON: {"version":12,"releaseId":88,"publishedAt":"...","publishedBy":"admin"}
+```
+
+客户端只 watch `/config/{env}/{app}/{namespace}` 这一个 key，收到事件后解码出完整 map，本地直接替换。
+
+## 四、PostgreSQL 数据模型
+
+```sql
+CREATE TABLE applications (
+    id            BIGSERIAL PRIMARY KEY,
+    app_code      VARCHAR(64) UNIQUE NOT NULL,
+    name          VARCHAR(128) NOT NULL,
+    department    VARCHAR(128),
+    owner         VARCHAR(64),
+    description   TEXT,
+    created_at    TIMESTAMPTZ NOT NULL DEFAULT now(),
+    updated_at    TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE TABLE environments (
+    id            BIGSERIAL PRIMARY KEY,
+    env_code      VARCHAR(32) UNIQUE NOT NULL,   -- DEV/TEST/STAGING/PROD
+    name          VARCHAR(64) NOT NULL,
+    sort_order    INT NOT NULL DEFAULT 0,
+    description   TEXT
+);
+
+CREATE TABLE namespaces (
+    id            BIGSERIAL PRIMARY KEY,
+    app_id        BIGINT NOT NULL REFERENCES applications(id) ON DELETE CASCADE,
+    name          VARCHAR(64) NOT NULL,
+    format        VARCHAR(16) NOT NULL DEFAULT 'properties', -- properties/yaml/json/xml
+    description   TEXT,
+    UNIQUE(app_id, name)
+);
+
+-- 草稿态配置项：value 是编辑中的值，released_value 是最近一次发布生效的值
+CREATE TABLE config_items (
+    id             BIGSERIAL PRIMARY KEY,
+    namespace_id   BIGINT NOT NULL REFERENCES namespaces(id) ON DELETE CASCADE,
+    env_id         BIGINT NOT NULL REFERENCES environments(id) ON DELETE CASCADE,
+    key            VARCHAR(256) NOT NULL,
+    value          TEXT NOT NULL,
+    released_value TEXT,               -- NULL 表示从未发布过（待发布·新增）
+    pending_delete BOOLEAN NOT NULL DEFAULT false,
+    comment        TEXT,
+    updated_by     VARCHAR(64),
+    updated_at     TIMESTAMPTZ NOT NULL DEFAULT now(),
+    UNIQUE(namespace_id, env_id, key)
+);
+
+CREATE TABLE releases (
+    id            BIGSERIAL PRIMARY KEY,
+    namespace_id  BIGINT NOT NULL REFERENCES namespaces(id),
+    env_id        BIGINT NOT NULL REFERENCES environments(id),
+    version       INT NOT NULL,
+    snapshot      JSONB NOT NULL,       -- 该版本完整的 key -> value
+    diff_added    INT DEFAULT 0,
+    diff_modified INT DEFAULT 0,
+    diff_removed  INT DEFAULT 0,
+    comment       TEXT,
+    operator      VARCHAR(64) NOT NULL,
+    etcd_revision BIGINT,               -- 写入 etcd 成功后回填，用于对账
+    status        VARCHAR(16) NOT NULL DEFAULT 'pending', -- pending/applied/failed
+    created_at    TIMESTAMPTZ NOT NULL DEFAULT now(),
+    UNIQUE(namespace_id, env_id, version)
+);
+
+-- Outbox：保证 DB 事务与 etcd 写入之间的最终一致
+CREATE TABLE release_outbox (
+    id            BIGSERIAL PRIMARY KEY,
+    release_id    BIGINT NOT NULL REFERENCES releases(id),
+    etcd_key      VARCHAR(512) NOT NULL,
+    payload       JSONB NOT NULL,
+    status        VARCHAR(16) NOT NULL DEFAULT 'pending', -- pending/done/failed
+    retry_count   INT NOT NULL DEFAULT 0,
+    created_at    TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE TABLE users (
+    id            BIGSERIAL PRIMARY KEY,
+    username      VARCHAR(64) UNIQUE NOT NULL,
+    password_hash VARCHAR(256) NOT NULL,
+    display_name  VARCHAR(64),
+    created_at    TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE TABLE roles (
+    id    BIGSERIAL PRIMARY KEY,
+    name  VARCHAR(32) UNIQUE NOT NULL   -- admin / app-owner / viewer
+);
+
+CREATE TABLE user_app_roles (          -- 用户对某个应用的角色（应用级 RBAC）
+    user_id  BIGINT NOT NULL REFERENCES users(id),
+    app_id   BIGINT NOT NULL REFERENCES applications(id),
+    role_id  BIGINT NOT NULL REFERENCES roles(id),
+    PRIMARY KEY (user_id, app_id)
+);
+
+CREATE TABLE audit_logs (
+    id           BIGSERIAL PRIMARY KEY,
+    actor        VARCHAR(64) NOT NULL,
+    action       VARCHAR(32) NOT NULL,   -- create/update/delete/publish/rollback
+    target_type  VARCHAR(32) NOT NULL,   -- app/namespace/env/config/release
+    target_id    BIGINT,
+    detail       JSONB,
+    created_at   TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+-- 灰度发布规则（可选，Phase 4 再做）
+CREATE TABLE gray_rules (
+    id            BIGSERIAL PRIMARY KEY,
+    namespace_id  BIGINT NOT NULL REFERENCES namespaces(id),
+    env_id        BIGINT NOT NULL REFERENCES environments(id),
+    rule_type     VARCHAR(16) NOT NULL,  -- ip / instance / percentage
+    rule_value    JSONB NOT NULL,        -- {"ips": [...]} 或 {"percentage": 20}
+    overrides     JSONB NOT NULL,        -- 灰度期间覆盖的 key -> value
+    enabled       BOOLEAN NOT NULL DEFAULT true,
+    created_at    TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+```
+
+## 五、Protobuf / gRPC 接口定义
+
+建议用 **grpc-gateway** 从同一份 proto 同时生成 gRPC（给 Go/Python SDK 用）和 REST（给 Web Console 用），避免维护两套接口。
+
+```protobuf
+syntax = "proto3";
+package configcenter.v1;
+option go_package = "github.com/yourorg/configcenter/pkg/proto/v1;configcenterv1";
+
+message ConfigItem {
+  string key = 1;
+  string value = 2;
+}
+
+// ---- 读取 / 监听 ----
+message GetConfigRequest {
+  string env = 1;
+  string app = 2;
+  string namespace = 3;
+}
+message GetConfigResponse {
+  repeated ConfigItem items = 1;
+  int64 revision = 2;
+  int64 release_version = 3;
+}
+
+message WatchConfigRequest {
+  string env = 1;
+  string app = 2;
+  string namespace = 3;
+  int64 start_revision = 4; // 断线重连时从该 revision 继续，避免错过中间事件
+}
+message ConfigEvent {
+  enum EventType { FULL_SYNC = 0; UPDATED = 1; }
+  EventType type = 1;
+  repeated ConfigItem items = 2;
+  int64 revision = 3;
+}
+
+service ConfigService {
+  rpc GetConfig(GetConfigRequest) returns (GetConfigResponse);
+  rpc WatchConfig(WatchConfigRequest) returns (stream ConfigEvent);
+}
+
+// ---- 发布 / 回滚（管理面，Web Console 也走这里）----
+message PublishRequest {
+  string env = 1;
+  string app = 2;
+  string namespace = 3;
+  string comment = 4;
+  string operator = 5;
+}
+message PublishResponse {
+  int64 release_version = 1;
+  int64 etcd_revision = 2;
+}
+
+message RollbackRequest {
+  string env = 1;
+  string app = 2;
+  string namespace = 3;
+  int64 target_version = 4;
+  string operator = 5;
+}
+message RollbackResponse {
+  int64 new_release_version = 1;
+}
+
+service AdminService {
+  rpc PublishConfig(PublishRequest) returns (PublishResponse);
+  rpc RollbackConfig(RollbackRequest) returns (RollbackResponse);
+  // 应用/命名空间/环境/配置项的 CRUD 接口类似，此处略
+}
+```
+
+## 六、Go Config Server 实现要点
+
+### 目录结构
+
+```
+configcenter/
+├── cmd/server/main.go
+├── internal/
+│   ├── api/            # gRPC handler + grpc-gateway REST
+│   ├── service/        # 发布 / 回滚 / watch 扇出等业务逻辑
+│   ├── store/
+│   │   ├── postgres/   # repository（推荐 sqlc 生成，类型安全）
+│   │   └── etcdstore/  # etcd client 封装
+│   ├── outbox/         # outbox worker
+│   ├── cache/          # redis 封装（读缓存 + 内部事件）
+│   └── auth/           # JWT + RBAC 中间件
+├── pkg/
+│   ├── proto/v1/       # protoc 生成代码
+│   └── sdk/go/         # Go SDK，独立 module，方便业务方单独引用
+└── web/                # Web Console 前端
+```
+
+### 发布流程
+
+```go
+func (s *ConfigService) Publish(ctx context.Context, req *PublishRequest) (*PublishResponse, error) {
+	return s.db.WithTx(ctx, func(tx *sql.Tx) (*PublishResponse, error) {
+		items, err := s.repo.ListConfigItems(tx, req.NamespaceID, req.EnvID)
+		if err != nil {
+			return nil, err
+		}
+		pending := filterPending(items) // pendingDelete || releasedValue==nil || value!=releasedValue
+		if len(pending) == 0 {
+			return nil, ErrNoPendingChanges
+		}
+
+		version := s.repo.NextReleaseVersion(tx, req.NamespaceID, req.EnvID)
+		snapshot := buildSnapshot(items) // 去掉 pendingDelete 的 key
+		releaseID, err := s.repo.InsertRelease(tx, version, snapshot, req.Comment, req.Operator)
+		if err != nil {
+			return nil, err
+		}
+
+		// 关键：写 outbox 而不是直接写 etcd，和 DB 事务在同一个提交单元里
+		etcdKey := buildEtcdKey(req.Env, req.App, req.Namespace)
+		if err := s.repo.InsertOutbox(tx, releaseID, etcdKey, snapshot); err != nil {
+			return nil, err
+		}
+		s.repo.MarkConfigItemsReleased(tx, pending)
+
+		return &PublishResponse{ReleaseVersion: version}, nil
+	})
+}
+```
+
+### Outbox Worker（异步写 etcd，失败可重试）
+
+```go
+func (w *OutboxWorker) Run(ctx context.Context) {
+	ticker := time.NewTicker(500 * time.Millisecond)
+	defer ticker.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-ticker.C:
+			rows, _ := w.repo.FetchPendingOutbox(ctx, 50)
+			for _, row := range rows {
+				payload, _ := json.Marshal(row.Payload)
+				resp, err := w.etcd.Put(ctx, row.EtcdKey, string(payload))
+				if err != nil {
+					w.repo.MarkOutboxFailed(ctx, row.ID) // retry_count++
+					continue
+				}
+				w.repo.MarkOutboxDone(ctx, row.ID)
+				w.repo.UpdateReleaseRevision(ctx, row.ReleaseID, resp.Header.Revision, "applied")
+			}
+		}
+	}
+}
+```
+
+### Watch 扇出（避免 N 个 Server 实例 = N 倍 etcd watch 连接）
+
+```go
+type WatchHub struct {
+	mu   sync.RWMutex
+	subs map[string]map[chan *pb.ConfigEvent]struct{}
+	etcd *clientv3.Client
+}
+
+func (h *WatchHub) Subscribe(key string) (<-chan *pb.ConfigEvent, func()) {
+	ch := make(chan *pb.ConfigEvent, 8)
+	h.mu.Lock()
+	if h.subs[key] == nil {
+		h.subs[key] = map[chan *pb.ConfigEvent]struct{}{}
+		go h.watchKey(key) // 同一个 key 只建一条 etcd watch
+	}
+	h.subs[key][ch] = struct{}{}
+	h.mu.Unlock()
+	return ch, func() { h.unsubscribe(key, ch) }
+}
+
+func (h *WatchHub) watchKey(key string) {
+	wc := h.etcd.Watch(context.Background(), key)
+	for resp := range wc {
+		for _, ev := range resp.Events {
+			evt := &pb.ConfigEvent{Type: pb.ConfigEvent_UPDATED, Items: decode(ev.Kv.Value), Revision: ev.Kv.ModRevision}
+			h.broadcast(key, evt)
+		}
+	}
+}
+```
+
+gRPC 层只需要订阅 Hub 并转发给客户端流：
+
+```go
+func (s *ConfigService) WatchConfig(req *pb.WatchConfigRequest, stream pb.ConfigService_WatchConfigServer) error {
+	key := buildEtcdKey(req.Env, req.App, req.Namespace)
+	initial, rev := s.loadCurrent(key)
+	if err := stream.Send(&pb.ConfigEvent{Type: pb.ConfigEvent_FULL_SYNC, Items: initial, Revision: rev}); err != nil {
+		return err
+	}
+	ch, cancel := s.hub.Subscribe(key)
+	defer cancel()
+	for {
+		select {
+		case evt := <-ch:
+			if err := stream.Send(evt); err != nil {
+				return err
+			}
+		case <-stream.Context().Done():
+			return nil
+		}
+	}
+}
+```
+
+### 回滚
+
+回滚不是"覆盖旧记录"，而是**生成一条新的 release**（内容等于目标历史版本的 snapshot），走和发布完全一样的 outbox 流程——这样回滚本身也留痕，历史可追溯。
+
+## 七、Go SDK
+
+```go
+package configsdk
+
+type Client struct {
+	stub  pb.ConfigServiceClient
+	cache sync.Map // namespace -> map[string]string
+}
+
+func New(addr string) (*Client, error) {
+	conn, err := grpc.Dial(addr, grpc.WithTransportCredentials(insecure.NewCredentials()))
+	if err != nil {
+		return nil, err
+	}
+	return &Client{stub: pb.NewConfigServiceClient(conn)}, nil
+}
+
+func (c *Client) GetString(namespace, key, defaultVal string) string {
+	if m, ok := c.cache.Load(namespace); ok {
+		if v, ok := m.(map[string]string)[key]; ok {
+			return v
+		}
+	}
+	return defaultVal
+}
+
+// 后台常驻 goroutine，断线自动重连
+func (c *Client) WatchAndSync(ctx context.Context, env, app, namespace string) {
+	for {
+		stream, err := c.stub.WatchConfig(ctx, &pb.WatchConfigRequest{Env: env, App: app, Namespace: namespace})
+		if err == nil {
+			for {
+				evt, err := stream.Recv()
+				if err != nil {
+					break
+				}
+				c.applyEvent(namespace, evt)
+			}
+		}
+		select {
+		case <-ctx.Done():
+			return
+		case <-time.After(2 * time.Second): // 重连退避
+		}
+	}
+}
+```
+
+## 八、Python SDK
+
+不直接连 etcd（etcd 官方不维护 Python client），而是通过 gRPC 连 Go Config Server：
+
+```python
+import grpc
+import threading
+import time
+from configcenter.v1 import config_pb2, config_pb2_grpc
+
+class ConfigClient:
+    def __init__(self, addr: str):
+        self._channel = grpc.insecure_channel(addr)
+        self._stub = config_pb2_grpc.ConfigServiceStub(self._channel)
+        self._cache = {}
+        self._lock = threading.Lock()
+
+    def get(self, namespace: str, key: str, default=None):
+        with self._lock:
+            return self._cache.get(namespace, {}).get(key, default)
+
+    def start_background_watch(self, env: str, app: str, namespace: str):
+        t = threading.Thread(target=self._watch_loop, args=(env, app, namespace), daemon=True)
+        t.start()
+
+    def _watch_loop(self, env, app, namespace):
+        req = config_pb2.WatchConfigRequest(env=env, app=app, namespace=namespace)
+        while True:
+            try:
+                for event in self._stub.WatchConfig(req):
+                    with self._lock:
+                        self._cache[namespace] = {i.key: i.value for i in event.items}
+            except grpc.RpcError:
+                time.sleep(2)  # 断线重连
+```
+
+## 九、Web Console 对接方式
+
+之前给你做的前端 Demo（应用/命名空间/环境/配置项 CRUD + 发布 diff 预览 + 发布历史回滚）里的数据结构和这里的 PG 表结构是对齐的，接入真实后端时只需要：
+
+1. 把内存里的 `useState` 数据源换成对 `grpc-gateway` 生成的 REST 接口的 `fetch` 调用；
+2. 发布按钮调用 `POST /v1/publish`，历史列表调用 `GET /v1/releases`，回滚调用 `POST /v1/rollback`；
+3. 因为发布是异步落 etcd（outbox），Web Console 发布后可以轮询 release 的 `status` 字段（pending → applied），或者用 Redis pub/sub + SSE 做实时状态推送。
+
+## 十、部署与运维要点
+
+- **etcd 独立部署**：3 或 5 节点集群，不与业务系统共享，专门服务配置分发；
+- **控制 etcd 数据量**：只放"当前生效配置"，历史/审计一律留在 PG，etcd 库大小尽量控制在几个 GB 以内；
+- **定期 compact + defrag**：etcd 的 MVCC 历史 revision 会持续占用磁盘，需要定期 `etcdctl compact` 和 `defrag`；
+- **监控**：etcd 自带 `/metrics`（Prometheus），重点关注 db 大小、leader 变更次数、watch 连接数；Config Server 侧关注发布成功率、outbox 积压量、gRPC 延迟；
+- **无状态水平扩展**：Config Server 本身无状态，可以随意加实例，配合前面的 WatchHub 设计，不会导致 etcd 连接数暴涨；
+- **灾备**：etcd 定期 `snapshot save`；PostgreSQL 走常规主从 + 定期备份；
+- **安全**：etcd 只对 Config Server 开放访问（不直接暴露给业务服务），Config Server 与 etcd 之间开 TLS。
+
+## 十一、分阶段落地路线图
+
+| 阶段 | 内容 | 周期建议 |
+|---|---|---|
+| Phase 1 | PG 建表 + CRUD REST API + Web Console 接入真实接口（发布先只落 PG，不接 etcd） | 2–3 周 |
+| Phase 2 | 接入 etcd：Outbox Worker、GetConfig 接口、Go/Python SDK（先只支持 Get，不支持 Watch） | 2 周 |
+| Phase 3 | WatchConfig 全链路：WatchHub 扇出、SDK 长连接自动重连、**SDK 本地文件缓存兜底**（Server/etcd 故障时业务进程仍能用最后一次缓存启动，这是必须做的，Apollo/Nacos 都有） | 2 周 |
+| Phase 4 | RBAC（应用级角色）、审计日志、灰度发布规则 | 2–3 周 |
+| Phase 5 | 高可用加固：etcd 多机房、监控告警、压测 | 持续 |
+
+Phase 1 完全可以复用你现在这份前端 Demo 直接改造，不用重写界面。
diff --git a/deploy/kubernetes/configcenter.yaml b/deploy/kubernetes/configcenter.yaml
new file mode 100644
index 0000000..b45afcd
--- /dev/null
+++ b/deploy/kubernetes/configcenter.yaml
@@ -0,0 +1,218 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: configcenter
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: configcenter
+  namespace: configcenter
+data:
+  HTTP_ADDR: ":8080"
+  ETCD_ENDPOINTS: "http://etcd:2379"
+  OUTBOX_INTERVAL: "500ms"
+  OUTBOX_BATCH_SIZE: "50"
+  OUTBOX_MAX_RETRY: "12"
+  AUTH_ENABLED: "true"
+  JWT_TTL: "8h"
+  CORS_ALLOWED_ORIGINS: "https://config.example.com"
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: etcd
+  namespace: configcenter
+spec:
+  serviceName: etcd-peer
+  replicas: 3
+  selector:
+    matchLabels:
+      app: etcd
+  template:
+    metadata:
+      labels:
+        app: etcd
+      annotations:
+        prometheus.io/scrape: "true"
+        prometheus.io/port: "2379"
+        prometheus.io/path: /metrics
+    spec:
+      terminationGracePeriodSeconds: 30
+      topologySpreadConstraints:
+        - maxSkew: 1
+          topologyKey: topology.kubernetes.io/zone
+          whenUnsatisfiable: DoNotSchedule
+          labelSelector:
+            matchLabels: { app: etcd }
+      affinity:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            - labelSelector:
+                matchLabels:
+                  app: etcd
+              topologyKey: kubernetes.io/hostname
+      containers:
+        - name: etcd
+          image: quay.io/coreos/etcd:v3.5.17
+          command: ["/bin/sh", "-ec"]
+          args:
+            - >-
+              exec etcd
+              --name="${HOSTNAME}"
+              --data-dir=/var/lib/etcd
+              --listen-client-urls=http://0.0.0.0:2379
+              --advertise-client-urls="http://${HOSTNAME}.etcd-peer.configcenter.svc.cluster.local:2379"
+              --listen-peer-urls=http://0.0.0.0:2380
+              --initial-advertise-peer-urls="http://${HOSTNAME}.etcd-peer.configcenter.svc.cluster.local:2380"
+              --initial-cluster="etcd-0=http://etcd-0.etcd-peer.configcenter.svc.cluster.local:2380,etcd-1=http://etcd-1.etcd-peer.configcenter.svc.cluster.local:2380,etcd-2=http://etcd-2.etcd-peer.configcenter.svc.cluster.local:2380"
+              --initial-cluster-state=new
+              --initial-cluster-token=configcenter-etcd
+              --auto-compaction-retention=1
+              --auto-compaction-mode=periodic
+          ports:
+            - { name: client, containerPort: 2379 }
+            - { name: peer, containerPort: 2380 }
+          readinessProbe:
+            exec:
+              command: ["etcdctl", "endpoint", "health"]
+            initialDelaySeconds: 10
+            periodSeconds: 5
+          resources:
+            requests: { cpu: "250m", memory: "512Mi" }
+            limits: { cpu: "2", memory: "2Gi" }
+          volumeMounts:
+            - { name: data, mountPath: /var/lib/etcd }
+  volumeClaimTemplates:
+    - metadata:
+        name: data
+      spec:
+        accessModes: ["ReadWriteOnce"]
+        resources:
+          requests:
+            storage: 20Gi
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: etcd-peer
+  namespace: configcenter
+spec:
+  clusterIP: None
+  publishNotReadyAddresses: true
+  selector: { app: etcd }
+  ports:
+    - { name: peer, port: 2380, targetPort: peer }
+    - { name: client, port: 2379, targetPort: client }
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: etcd
+  namespace: configcenter
+spec:
+  selector: { app: etcd }
+  ports:
+    - { name: client, port: 2379, targetPort: client }
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: etcd
+  namespace: configcenter
+spec:
+  maxUnavailable: 1
+  selector:
+    matchLabels: { app: etcd }
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: configcenter
+  namespace: configcenter
+spec:
+  replicas: 3
+  selector:
+    matchLabels: { app: configcenter }
+  template:
+    metadata:
+      labels: { app: configcenter }
+      annotations:
+        prometheus.io/scrape: "true"
+        prometheus.io/port: "8080"
+        prometheus.io/path: /metrics
+    spec:
+      topologySpreadConstraints:
+        - maxSkew: 1
+          topologyKey: topology.kubernetes.io/zone
+          whenUnsatisfiable: ScheduleAnyway
+          labelSelector:
+            matchLabels: { app: configcenter }
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              podAffinityTerm:
+                labelSelector:
+                  matchLabels: { app: configcenter }
+                topologyKey: kubernetes.io/hostname
+      containers:
+        - name: server
+          image: ghcr.io/yourorg/configcenter:latest
+          envFrom:
+            - configMapRef: { name: configcenter }
+            - secretRef: { name: configcenter-secrets }
+          ports:
+            - { name: http, containerPort: 8080 }
+          readinessProbe:
+            httpGet: { path: /health/ready, port: http }
+            periodSeconds: 5
+          livenessProbe:
+            httpGet: { path: /health/live, port: http }
+            periodSeconds: 10
+          resources:
+            requests: { cpu: "200m", memory: "256Mi" }
+            limits: { cpu: "1", memory: "1Gi" }
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: configcenter
+  namespace: configcenter
+spec:
+  selector: { app: configcenter }
+  ports:
+    - { name: http, port: 8080, targetPort: http }
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: configcenter
+  namespace: configcenter
+spec:
+  minAvailable: 2
+  selector:
+    matchLabels: { app: configcenter }
+---
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: configcenter
+  namespace: configcenter
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: configcenter
+  minReplicas: 3
+  maxReplicas: 10
+  behavior:
+    scaleDown:
+      stabilizationWindowSeconds: 300
+  metrics:
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          averageUtilization: 65
diff --git a/deploy/monitoring/alerts.yml b/deploy/monitoring/alerts.yml
new file mode 100644
index 0000000..3b958f4
--- /dev/null
+++ b/deploy/monitoring/alerts.yml
@@ -0,0 +1,54 @@
+groups:
+  - name: configcenter
+    rules:
+      - alert: ConfigCenterDown
+        expr: up{job="configcenter"} == 0
+        for: 2m
+        labels:
+          severity: critical
+        annotations:
+          summary: Config Center is unavailable
+
+      - alert: ConfigCenterOutboxBacklog
+        expr: configcenter_outbox_pending > 100
+        for: 5m
+        labels:
+          severity: warning
+        annotations:
+          summary: Config Center outbox backlog is growing
+
+      - alert: ConfigCenterOutboxFailed
+        expr: configcenter_outbox_failed > 0
+        for: 1m
+        labels:
+          severity: critical
+        annotations:
+          summary: Config Center has terminally failed releases
+
+      - alert: ConfigCenterHighHTTPErrorRate
+        expr: |
+          sum(rate(configcenter_http_requests_total{status=~"5.."}[5m]))
+          /
+          clamp_min(sum(rate(configcenter_http_requests_total[5m])), 0.001)
+          > 0.01
+        for: 5m
+        labels:
+          severity: warning
+        annotations:
+          summary: Config Center 5xx rate exceeds 1%
+
+      - alert: EtcdDown
+        expr: up{job="etcd"} == 0
+        for: 2m
+        labels:
+          severity: critical
+        annotations:
+          summary: Config Center etcd is unavailable
+
+      - alert: EtcdNoLeader
+        expr: etcd_server_has_leader{job="etcd"} == 0
+        for: 1m
+        labels:
+          severity: critical
+        annotations:
+          summary: Config Center etcd member has no leader
diff --git a/deploy/monitoring/prometheus.yml b/deploy/monitoring/prometheus.yml
new file mode 100644
index 0000000..ac84af9
--- /dev/null
+++ b/deploy/monitoring/prometheus.yml
@@ -0,0 +1,17 @@
+global:
+  scrape_interval: 15s
+  evaluation_interval: 15s
+
+rule_files:
+  - /etc/prometheus/alerts.yml
+
+scrape_configs:
+  - job_name: configcenter
+    metrics_path: /metrics
+    static_configs:
+      - targets: ["server:8080"]
+
+  - job_name: etcd
+    metrics_path: /metrics
+    static_configs:
+      - targets: ["etcd:2379"]
diff --git a/go.mod b/go.mod
new file mode 100644
index 0000000..9fd1c36
--- /dev/null
+++ b/go.mod
@@ -0,0 +1,32 @@
+module github.com/longpeng/configcenter
+
+go 1.24.0
+
+require (
+	github.com/jackc/pgx/v5 v5.7.2
+	go.etcd.io/etcd/client/v3 v3.6.7
+)
+
+require (
+	github.com/coreos/go-semver v0.3.1 // indirect
+	github.com/coreos/go-systemd/v22 v22.5.0 // indirect
+	github.com/gogo/protobuf v1.3.2 // indirect
+	github.com/golang/protobuf v1.5.4 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3 // indirect
+	github.com/jackc/pgpassfile v1.0.0 // indirect
+	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
+	github.com/jackc/puddle/v2 v2.2.2 // indirect
+	go.etcd.io/etcd/api/v3 v3.6.7 // indirect
+	go.etcd.io/etcd/client/pkg/v3 v3.6.7 // indirect
+	go.uber.org/multierr v1.11.0 // indirect
+	go.uber.org/zap v1.27.0 // indirect
+	golang.org/x/crypto v0.42.0 // indirect
+	golang.org/x/net v0.45.0 // indirect
+	golang.org/x/sync v0.17.0 // indirect
+	golang.org/x/sys v0.36.0 // indirect
+	golang.org/x/text v0.29.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20250303144028-a0af3efb3deb // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250303144028-a0af3efb3deb // indirect
+	google.golang.org/grpc v1.71.1 // indirect
+	google.golang.org/protobuf v1.36.5 // indirect
+)
diff --git a/go.sum b/go.sum
new file mode 100644
index 0000000..9eae92b
--- /dev/null
+++ b/go.sum
@@ -0,0 +1,112 @@
+github.com/coreos/go-semver v0.3.1 h1:yi21YpKnrx1gt5R+la8n5WgS0kCrsPp33dmEyHReZr4=
+github.com/coreos/go-semver v0.3.1/go.mod h1:irMmmIw/7yzSRPWryHsK7EYSg09caPQL03VsM8rvUec=
+github.com/coreos/go-systemd/v22 v22.5.0 h1:RrqgGjYQKalulkV8NGVIfkXQf6YYmOyiJKk8iXXhfZs=
+github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
+github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
+github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
+github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
+github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
+github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
+github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
+github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3 h1:5ZPtiqj0JL5oKWmcsq4VMaAW5ukBEgSGXEN89zeH1Jo=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3/go.mod h1:ndYquD05frm2vACXE1nsccT4oJzjhw2arTS2cpUD1PI=
+github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM=
+github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
+github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo=
+github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
+github.com/jackc/pgx/v5 v5.7.2 h1:mLoDLV6sonKlvjIEsV56SkWNCnuNv531l94GaIzO+XI=
+github.com/jackc/pgx/v5 v5.7.2/go.mod h1:ncY89UGWxg82EykZUwSpUKEfccBGGYq1xjrOpsbsfGQ=
+github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
+github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
+github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
+github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+go.etcd.io/etcd/api/v3 v3.6.7 h1:7BNJ2gQmc3DNM+9cRkv7KkGQDayElg8x3X+tFDYS+E0=
+go.etcd.io/etcd/api/v3 v3.6.7/go.mod h1:xJ81TLj9hxrYYEDmXTeKURMeY3qEDN24hqe+q7KhbnI=
+go.etcd.io/etcd/client/pkg/v3 v3.6.7 h1:vvzgyozz46q+TyeGBuFzVuI53/yd133CHceNb/AhBVs=
+go.etcd.io/etcd/client/pkg/v3 v3.6.7/go.mod h1:2IVulJ3FZ/czIGl9T4lMF1uxzrhRahLqe+hSgy+Kh7Q=
+go.etcd.io/etcd/client/v3 v3.6.7 h1:9WqA5RpIBtdMxAy1ukXLAdtg2pAxNqW5NUoO2wQrE6U=
+go.etcd.io/etcd/client/v3 v3.6.7/go.mod h1:2XfROY56AXnUqGsvl+6k29wrwsSbEh1lAouQB1vHpeE=
+go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
+go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
+go.opentelemetry.io/otel v1.34.0 h1:zRLXxLCgL1WyKsPVrgbSdMN4c0FMkDAskSTQP+0hdUY=
+go.opentelemetry.io/otel v1.34.0/go.mod h1:OWFPOQ+h4G8xpyjgqo4SxJYdDQ/qmRH+wivy7zzx9oI=
+go.opentelemetry.io/otel/metric v1.34.0 h1:+eTR3U0MyfWjRDhmFMxe2SsW64QrZ84AOhvqS7Y+PoQ=
+go.opentelemetry.io/otel/metric v1.34.0/go.mod h1:CEDrp0fy2D0MvkXE+dPV7cMi8tWZwX3dmaIhwPOaqHE=
+go.opentelemetry.io/otel/sdk v1.34.0 h1:95zS4k/2GOy069d321O8jWgYsW3MzVV+KuSPKp7Wr1A=
+go.opentelemetry.io/otel/sdk v1.34.0/go.mod h1:0e/pNiaMAqaykJGKbi+tSjWfNNHMTxoC9qANsCzbyxU=
+go.opentelemetry.io/otel/sdk/metric v1.34.0 h1:5CeK9ujjbFVL5c1PhLuStg1wxA7vQv7ce1EK0Gyvahk=
+go.opentelemetry.io/otel/sdk/metric v1.34.0/go.mod h1:jQ/r8Ze28zRKoNRdkjCZxfs6YvBTG1+YIqyFVFYec5w=
+go.opentelemetry.io/otel/trace v1.34.0 h1:+ouXS2V8Rd4hp4580a8q23bg0azF2nI8cqLYnC8mh/k=
+go.opentelemetry.io/otel/trace v1.34.0/go.mod h1:Svm7lSjQD7kG7KJ/MUHPVXSDGz2OX4h0M2jHBhmSfRE=
+go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
+go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
+go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
+go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
+go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
+go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.42.0 h1:chiH31gIWm57EkTXpwnqf8qeuMUi0yekh6mT2AvFlqI=
+golang.org/x/crypto v0.42.0/go.mod h1:4+rDnOTJhQCx2q7/j6rAN5XDw8kPjeaXEUR2eL94ix8=
+golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
+golang.org/x/net v0.45.0 h1:RLBg5JKixCy82FtLJpeNlVM0nrSqpCRYzVU1n8kj0tM=
+golang.org/x/net v0.45.0/go.mod h1:ECOoLqd5U3Lhyeyo/QDCEVQ4sNgYsqvCZ722XogGieY=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.17.0 h1:l60nONMj9l5drqw6jlhIELNv9I0A4OFgRsG9k2oT9Ug=
+golang.org/x/sync v0.17.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.36.0 h1:KVRy2GtZBrk1cBYA7MKu5bEZFxQk4NIDV6RLVcC8o0k=
+golang.org/x/sys v0.36.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.29.0 h1:1neNs90w9YzJ9BocxfsQNHKuAT4pkghyXc4nhZ6sJvk=
+golang.org/x/text v0.29.0/go.mod h1:7MhJOA9CD2qZyOKYazxdYMF85OwPdEr9jTtBpO7ydH4=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
+golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+google.golang.org/genproto/googleapis/api v0.0.0-20250303144028-a0af3efb3deb h1:p31xT4yrYrSM/G4Sn2+TNUkVhFCbG9y8itM2S6Th950=
+google.golang.org/genproto/googleapis/api v0.0.0-20250303144028-a0af3efb3deb/go.mod h1:jbe3Bkdp+Dh2IrslsFCklNhweNTBgSYanP1UXhJDhKg=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250303144028-a0af3efb3deb h1:TLPQVbx1GJ8VKZxz52VAxl1EBgKXXbTiU9Fc5fZeLn4=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250303144028-a0af3efb3deb/go.mod h1:LuRYeWDFV6WOn90g357N17oMCaxpgCnbi/44qJvDn2I=
+google.golang.org/grpc v1.71.1 h1:ffsFWr7ygTUscGPI0KKK6TLrGz0476KUvvsbqWK0rPI=
+google.golang.org/grpc v1.71.1/go.mod h1:H0GRtasmQOh9LkFoCPDu3ZrwUtD1YGE+b2vYBYd/8Ec=
+google.golang.org/protobuf v1.36.5 h1:tPhr+woSbjfYvY6/GPufUoYizxw1cF/yFoxJ2fmpwlM=
+google.golang.org/protobuf v1.36.5/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/internal/api/httpapi/server.go b/internal/api/httpapi/server.go
new file mode 100644
index 0000000..546a302
--- /dev/null
+++ b/internal/api/httpapi/server.go
@@ -0,0 +1,1023 @@
+package httpapi
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"log/slog"
+	"net/http"
+	"strconv"
+	"strings"
+	"time"
+	"unicode"
+
+	authpkg "github.com/longpeng/configcenter/internal/auth"
+	"github.com/longpeng/configcenter/internal/domain"
+	"github.com/longpeng/configcenter/internal/gray"
+	metricspkg "github.com/longpeng/configcenter/internal/metrics"
+	runtimepkg "github.com/longpeng/configcenter/internal/runtime"
+	"github.com/longpeng/configcenter/internal/store"
+	"github.com/longpeng/configcenter/internal/watch"
+)
+
+type Server struct {
+	store          store.Store
+	runtime        runtimepkg.Store
+	hub            *watch.Hub
+	logger         *slog.Logger
+	authorizer     *authpkg.Manager
+	metrics        *metricspkg.Collector
+	allowedOrigins map[string]struct{}
+	mux            *http.ServeMux
+}
+
+type responseEnvelope struct {
+	Data any `json:"data"`
+}
+
+type errorEnvelope struct {
+	Error apiError `json:"error"`
+}
+
+type apiError struct {
+	Code    string `json:"code"`
+	Message string `json:"message"`
+}
+
+func New(repository store.Store, runtimeStore runtimepkg.Store, hub *watch.Hub, authorizer *authpkg.Manager, metrics *metricspkg.Collector, allowedOrigins []string, logger *slog.Logger) *Server {
+	s := &Server{store: repository, runtime: runtimeStore, hub: hub, authorizer: authorizer, metrics: metrics, logger: logger, mux: http.NewServeMux(), allowedOrigins: make(map[string]struct{}, len(allowedOrigins))}
+	for _, origin := range allowedOrigins {
+		s.allowedOrigins[origin] = struct{}{}
+	}
+	s.routes()
+	return s
+}
+
+func (s *Server) Handler() http.Handler {
+	return s.recover(s.cors(s.log(s.authenticate(s.mux))))
+}
+
+func (s *Server) routes() {
+	s.mux.HandleFunc("GET /health/live", func(w http.ResponseWriter, _ *http.Request) {
+		writeJSON(w, http.StatusOK, map[string]string{"status": "ok"})
+	})
+	s.mux.HandleFunc("GET /health/ready", s.ready)
+	s.mux.Handle("GET /metrics", s.metrics.Handler(s.store))
+	s.mux.HandleFunc("POST /v1/auth/login", s.login)
+	s.mux.HandleFunc("GET /v1/me", s.me)
+	s.mux.HandleFunc("GET /v1/users", s.listUsers)
+	s.mux.HandleFunc("POST /v1/users", s.createUser)
+	s.mux.HandleFunc("GET /v1/users/{id}/roles", s.listUserRoles)
+	s.mux.HandleFunc("PUT /v1/users/{id}/roles/{appId}", s.setUserRole)
+	s.mux.HandleFunc("DELETE /v1/users/{id}/roles/{appId}", s.deleteUserRole)
+
+	s.mux.HandleFunc("GET /v1/applications", s.listApplications)
+	s.mux.HandleFunc("POST /v1/applications", s.createApplication)
+	s.mux.HandleFunc("PUT /v1/applications/{id}", s.updateApplication)
+	s.mux.HandleFunc("DELETE /v1/applications/{id}", s.deleteApplication)
+
+	s.mux.HandleFunc("GET /v1/environments", s.listEnvironments)
+	s.mux.HandleFunc("POST /v1/environments", s.createEnvironment)
+	s.mux.HandleFunc("PUT /v1/environments/{id}", s.updateEnvironment)
+	s.mux.HandleFunc("DELETE /v1/environments/{id}", s.deleteEnvironment)
+
+	s.mux.HandleFunc("GET /v1/namespaces", s.listNamespaces)
+	s.mux.HandleFunc("POST /v1/namespaces", s.createNamespace)
+	s.mux.HandleFunc("PUT /v1/namespaces/{id}", s.updateNamespace)
+	s.mux.HandleFunc("DELETE /v1/namespaces/{id}", s.deleteNamespace)
+
+	s.mux.HandleFunc("GET /v1/config-items", s.listConfigItems)
+	s.mux.HandleFunc("POST /v1/config-items", s.createConfigItem)
+	s.mux.HandleFunc("PUT /v1/config-items/{id}", s.updateConfigItem)
+	s.mux.HandleFunc("DELETE /v1/config-items/{id}", s.deleteConfigItem)
+	s.mux.HandleFunc("POST /v1/config-items/{id}/restore", s.restoreConfigItem)
+
+	s.mux.HandleFunc("POST /v1/publish", s.publish)
+	s.mux.HandleFunc("POST /v1/rollback", s.rollback)
+	s.mux.HandleFunc("GET /v1/releases", s.listReleases)
+	s.mux.HandleFunc("GET /v1/releases/{id}", s.getRelease)
+	s.mux.HandleFunc("GET /v1/audit-logs", s.listAuditLogs)
+	s.mux.HandleFunc("GET /v1/gray-rules", s.listGrayRules)
+	s.mux.HandleFunc("POST /v1/gray-rules", s.createGrayRule)
+	s.mux.HandleFunc("PUT /v1/gray-rules/{id}", s.updateGrayRule)
+	s.mux.HandleFunc("DELETE /v1/gray-rules/{id}", s.deleteGrayRule)
+
+	s.mux.HandleFunc("GET /v1/config", s.getRuntimeConfig)
+	s.mux.HandleFunc("GET /v1/watch", s.watchRuntimeConfig)
+}
+
+func (s *Server) ready(w http.ResponseWriter, r *http.Request) {
+	ctx, cancel := context.WithTimeout(r.Context(), 2*time.Second)
+	defer cancel()
+	if err := s.store.Ping(ctx); err != nil {
+		writeError(w, http.StatusServiceUnavailable, "store_unavailable", "控制面存储不可用")
+		return
+	}
+	if err := s.runtime.Ping(ctx); err != nil {
+		writeError(w, http.StatusServiceUnavailable, "runtime_unavailable", "运行时存储不可用")
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]string{"status": "ready"})
+}
+
+func (s *Server) login(w http.ResponseWriter, r *http.Request) {
+	var input struct {
+		Username string `json:"username"`
+		Password string `json:"password"`
+	}
+	if !decode(w, r, &input) {
+		return
+	}
+	token, principal, err := s.authorizer.Login(r.Context(), input.Username, input.Password)
+	if err != nil {
+		s.writeAuthError(w, err)
+		return
+	}
+	writeJSON(w, http.StatusOK, responseEnvelope{Data: map[string]any{"token": token, "expiresIn": s.authorizer.TTLSeconds(), "user": principal}})
+}
+
+func (s *Server) me(w http.ResponseWriter, r *http.Request) {
+	principal, ok := authpkg.Principal(r.Context())
+	if !ok {
+		s.writeAuthError(w, authpkg.ErrUnauthorized)
+		return
+	}
+	roles := []domain.UserAppRole{}
+	if principal.UserID > 0 {
+		var err error
+		roles, err = s.store.ListUserAppRoles(r.Context(), principal.UserID)
+		if err != nil && !errors.Is(err, store.ErrNotFound) {
+			s.respond(w, nil, err, http.StatusOK)
+			return
+		}
+	}
+	writeJSON(w, http.StatusOK, responseEnvelope{Data: map[string]any{"user": principal, "roles": roles, "authEnabled": s.authorizer.Enabled()}})
+}
+
+func (s *Server) listUsers(w http.ResponseWriter, r *http.Request) {
+	if !s.requireAdmin(w, r) {
+		return
+	}
+	items, err := s.store.ListUsers(r.Context())
+	s.respond(w, items, err, http.StatusOK)
+}
+
+func (s *Server) createUser(w http.ResponseWriter, r *http.Request) {
+	if !s.requireAdmin(w, r) {
+		return
+	}
+	var input struct {
+		Username    string `json:"username"`
+		Password    string `json:"password"`
+		DisplayName string `json:"displayName"`
+		IsAdmin     bool   `json:"isAdmin"`
+	}
+	if !decode(w, r, &input) {
+		return
+	}
+	if !validCode(input.Username) || strings.TrimSpace(input.DisplayName) == "" {
+		writeError(w, http.StatusBadRequest, "invalid_argument", "用户名格式不正确或显示名称为空")
+		return
+	}
+	item, err := s.authorizer.CreateUser(r.Context(), domain.User{Username: input.Username, DisplayName: input.DisplayName, IsAdmin: input.IsAdmin, UpdatedBy: actor(r)}, input.Password)
+	if err != nil && strings.Contains(err.Error(), "12 characters") {
+		writeError(w, http.StatusBadRequest, "weak_password", "密码至少需要 12 个字符")
+		return
+	}
+	s.respond(w, item, err, http.StatusCreated)
+}
+
+func (s *Server) listUserRoles(w http.ResponseWriter, r *http.Request) {
+	if !s.requireAdmin(w, r) {
+		return
+	}
+	userID, ok := pathID(w, r)
+	if !ok {
+		return
+	}
+	items, err := s.store.ListUserAppRoles(r.Context(), userID)
+	s.respond(w, items, err, http.StatusOK)
+}
+
+func (s *Server) setUserRole(w http.ResponseWriter, r *http.Request) {
+	if !s.requireAdmin(w, r) {
+		return
+	}
+	userID, appID, ok := rolePathIDs(w, r)
+	if !ok {
+		return
+	}
+	var input struct {
+		Role string `json:"role"`
+	}
+	if !decode(w, r, &input) {
+		return
+	}
+	if !authpkg.ValidRole(input.Role) {
+		writeError(w, http.StatusBadRequest, "invalid_argument", "角色必须是 admin、app-owner 或 viewer")
+		return
+	}
+	role := domain.UserAppRole{UserID: userID, AppID: appID, Role: input.Role, UpdatedBy: actor(r)}
+	err := s.store.SetUserAppRole(r.Context(), role)
+	s.respond(w, role, err, http.StatusOK)
+}
+
+func (s *Server) deleteUserRole(w http.ResponseWriter, r *http.Request) {
+	if !s.requireAdmin(w, r) {
+		return
+	}
+	userID, appID, ok := rolePathIDs(w, r)
+	if !ok {
+		return
+	}
+	s.respondEmpty(w, s.store.DeleteUserAppRole(r.Context(), userID, appID, actor(r)))
+}
+
+func (s *Server) listApplications(w http.ResponseWriter, r *http.Request) {
+	items, err := s.store.ListApplications(r.Context())
+	if err == nil {
+		filtered := make([]domain.Application, 0, len(items))
+		for _, item := range items {
+			if s.authorizer.CanAccessApp(r.Context(), item.ID, authpkg.RoleViewer) {
+				filtered = append(filtered, item)
+			}
+		}
+		items = filtered
+	}
+	s.respond(w, items, err, http.StatusOK)
+}
+
+func (s *Server) createApplication(w http.ResponseWriter, r *http.Request) {
+	if !s.requireAdmin(w, r) {
+		return
+	}
+	var input domain.Application
+	if !decode(w, r, &input) {
+		return
+	}
+	if !validCode(input.Code) || strings.TrimSpace(input.Name) == "" {
+		writeError(w, http.StatusBadRequest, "invalid_argument", "应用 ID 只能包含字母、数字、点、下划线和短横线，且名称不能为空")
+		return
+	}
+	input.Code, input.Name = strings.TrimSpace(input.Code), strings.TrimSpace(input.Name)
+	input.UpdatedBy = actor(r)
+	item, err := s.store.CreateApplication(r.Context(), input)
+	s.respond(w, item, err, http.StatusCreated)
+}
+
+func (s *Server) updateApplication(w http.ResponseWriter, r *http.Request) {
+	id, ok := pathID(w, r)
+	if !ok {
+		return
+	}
+	if !s.requireApp(w, r, id, authpkg.RoleAppOwner) {
+		return
+	}
+	var input domain.Application
+	if !decode(w, r, &input) {
+		return
+	}
+	if strings.TrimSpace(input.Name) == "" {
+		writeError(w, http.StatusBadRequest, "invalid_argument", "应用名称不能为空")
+		return
+	}
+	input.UpdatedBy = actor(r)
+	item, err := s.store.UpdateApplication(r.Context(), id, input)
+	s.respond(w, item, err, http.StatusOK)
+}
+
+func (s *Server) deleteApplication(w http.ResponseWriter, r *http.Request) {
+	if !s.requireAdmin(w, r) {
+		return
+	}
+	id, ok := pathID(w, r)
+	if !ok {
+		return
+	}
+	err := s.store.DeleteApplication(r.Context(), id, actor(r))
+	s.respondEmpty(w, err)
+}
+
+func (s *Server) listEnvironments(w http.ResponseWriter, r *http.Request) {
+	items, err := s.store.ListEnvironments(r.Context())
+	s.respond(w, items, err, http.StatusOK)
+}
+
+func (s *Server) createEnvironment(w http.ResponseWriter, r *http.Request) {
+	if !s.requireAdmin(w, r) {
+		return
+	}
+	var input domain.Environment
+	if !decode(w, r, &input) {
+		return
+	}
+	input.Code = strings.ToUpper(strings.TrimSpace(input.Code))
+	if !validCode(input.Code) || strings.TrimSpace(input.Name) == "" {
+		writeError(w, http.StatusBadRequest, "invalid_argument", "环境编码格式不正确或名称为空")
+		return
+	}
+	input.UpdatedBy = actor(r)
+	item, err := s.store.CreateEnvironment(r.Context(), input)
+	s.respond(w, item, err, http.StatusCreated)
+}
+
+func (s *Server) updateEnvironment(w http.ResponseWriter, r *http.Request) {
+	if !s.requireAdmin(w, r) {
+		return
+	}
+	id, ok := pathID(w, r)
+	if !ok {
+		return
+	}
+	var input domain.Environment
+	if !decode(w, r, &input) {
+		return
+	}
+	if strings.TrimSpace(input.Name) == "" {
+		writeError(w, http.StatusBadRequest, "invalid_argument", "环境名称不能为空")
+		return
+	}
+	input.UpdatedBy = actor(r)
+	item, err := s.store.UpdateEnvironment(r.Context(), id, input)
+	s.respond(w, item, err, http.StatusOK)
+}
+
+func (s *Server) deleteEnvironment(w http.ResponseWriter, r *http.Request) {
+	if !s.requireAdmin(w, r) {
+		return
+	}
+	id, ok := pathID(w, r)
+	if !ok {
+		return
+	}
+	err := s.store.DeleteEnvironment(r.Context(), id, actor(r))
+	s.respondEmpty(w, err)
+}
+
+func (s *Server) listNamespaces(w http.ResponseWriter, r *http.Request) {
+	var appID *int64
+	if raw := r.URL.Query().Get("appId"); raw != "" {
+		parsed, err := strconv.ParseInt(raw, 10, 64)
+		if err != nil || parsed <= 0 {
+			writeError(w, http.StatusBadRequest, "invalid_argument", "appId 格式不正确")
+			return
+		}
+		appID = &parsed
+		if !s.requireApp(w, r, parsed, authpkg.RoleViewer) {
+			return
+		}
+	}
+	items, err := s.store.ListNamespaces(r.Context(), appID)
+	if err == nil && appID == nil {
+		filtered := make([]domain.Namespace, 0, len(items))
+		for _, item := range items {
+			if s.authorizer.CanAccessApp(r.Context(), item.AppID, authpkg.RoleViewer) {
+				filtered = append(filtered, item)
+			}
+		}
+		items = filtered
+	}
+	s.respond(w, items, err, http.StatusOK)
+}
+
+func (s *Server) createNamespace(w http.ResponseWriter, r *http.Request) {
+	var input domain.Namespace
+	if !decode(w, r, &input) {
+		return
+	}
+	if input.AppID <= 0 || !validCode(input.Name) || !validFormat(input.Type) {
+		writeError(w, http.StatusBadRequest, "invalid_argument", "所属应用、命名空间名称或格式不正确")
+		return
+	}
+	if !s.requireApp(w, r, input.AppID, authpkg.RoleAppOwner) {
+		return
+	}
+	input.UpdatedBy = actor(r)
+	item, err := s.store.CreateNamespace(r.Context(), input)
+	s.respond(w, item, err, http.StatusCreated)
+}
+
+func (s *Server) updateNamespace(w http.ResponseWriter, r *http.Request) {
+	id, ok := pathID(w, r)
+	if !ok {
+		return
+	}
+	current, err := s.store.GetNamespace(r.Context(), id)
+	if err != nil {
+		s.respond(w, nil, err, http.StatusOK)
+		return
+	}
+	if !s.requireApp(w, r, current.AppID, authpkg.RoleAppOwner) {
+		return
+	}
+	var input domain.Namespace
+	if !decode(w, r, &input) {
+		return
+	}
+	if !validFormat(input.Type) {
+		writeError(w, http.StatusBadRequest, "invalid_argument", "命名空间格式不正确")
+		return
+	}
+	input.UpdatedBy = actor(r)
+	item, err := s.store.UpdateNamespace(r.Context(), id, input)
+	s.respond(w, item, err, http.StatusOK)
+}
+
+func (s *Server) deleteNamespace(w http.ResponseWriter, r *http.Request) {
+	id, ok := pathID(w, r)
+	if !ok {
+		return
+	}
+	current, err := s.store.GetNamespace(r.Context(), id)
+	if err != nil {
+		s.respond(w, nil, err, http.StatusOK)
+		return
+	}
+	if !s.requireApp(w, r, current.AppID, authpkg.RoleAppOwner) {
+		return
+	}
+	err = s.store.DeleteNamespace(r.Context(), id, actor(r))
+	s.respondEmpty(w, err)
+}
+
+func (s *Server) listConfigItems(w http.ResponseWriter, r *http.Request) {
+	appID, namespaceID, envID, ok := scopeIDs(w, r)
+	if !ok {
+		return
+	}
+	if !s.requireApp(w, r, appID, authpkg.RoleViewer) {
+		return
+	}
+	items, err := s.store.ListConfigItems(r.Context(), appID, namespaceID, envID)
+	s.respond(w, items, err, http.StatusOK)
+}
+
+func (s *Server) createConfigItem(w http.ResponseWriter, r *http.Request) {
+	var input domain.ConfigItem
+	if !decode(w, r, &input) {
+		return
+	}
+	input.UpdatedBy = actor(r)
+	if input.AppID <= 0 || input.NamespaceID <= 0 || input.EnvironmentID <= 0 || !validConfigKey(input.Key) || input.Value == "" {
+		writeError(w, http.StatusBadRequest, "invalid_argument", "配置范围、Key 或 Value 不正确")
+		return
+	}
+	if !s.requireApp(w, r, input.AppID, authpkg.RoleAppOwner) {
+		return
+	}
+	item, err := s.store.CreateConfigItem(r.Context(), input)
+	s.respond(w, item, err, http.StatusCreated)
+}
+
+func (s *Server) updateConfigItem(w http.ResponseWriter, r *http.Request) {
+	id, ok := pathID(w, r)
+	if !ok {
+		return
+	}
+	current, err := s.store.GetConfigItem(r.Context(), id)
+	if err != nil {
+		s.respond(w, nil, err, http.StatusOK)
+		return
+	}
+	if !s.requireApp(w, r, current.AppID, authpkg.RoleAppOwner) {
+		return
+	}
+	var input domain.ConfigItem
+	if !decode(w, r, &input) {
+		return
+	}
+	input.UpdatedBy = actor(r)
+	if input.Value == "" {
+		writeError(w, http.StatusBadRequest, "invalid_argument", "Value 不能为空")
+		return
+	}
+	item, err := s.store.UpdateConfigItem(r.Context(), id, input)
+	s.respond(w, item, err, http.StatusOK)
+}
+
+func (s *Server) deleteConfigItem(w http.ResponseWriter, r *http.Request) {
+	s.setConfigDelete(w, r, true)
+}
+
+func (s *Server) restoreConfigItem(w http.ResponseWriter, r *http.Request) {
+	s.setConfigDelete(w, r, false)
+}
+
+func (s *Server) setConfigDelete(w http.ResponseWriter, r *http.Request, pending bool) {
+	id, ok := pathID(w, r)
+	if !ok {
+		return
+	}
+	current, err := s.store.GetConfigItem(r.Context(), id)
+	if err != nil {
+		s.respond(w, nil, err, http.StatusOK)
+		return
+	}
+	if !s.requireApp(w, r, current.AppID, authpkg.RoleAppOwner) {
+		return
+	}
+	item, err := s.store.SetConfigItemPendingDelete(r.Context(), id, pending, actor(r))
+	s.respond(w, item, err, http.StatusOK)
+}
+
+func (s *Server) publish(w http.ResponseWriter, r *http.Request) {
+	var input domain.PublishRequest
+	if !decode(w, r, &input) {
+		return
+	}
+	input.Operator = actor(r)
+	if input.AppID <= 0 || input.NamespaceID <= 0 || input.EnvironmentID <= 0 {
+		writeError(w, http.StatusBadRequest, "invalid_argument", "发布范围不完整")
+		return
+	}
+	if !s.requireApp(w, r, input.AppID, authpkg.RoleAppOwner) {
+		return
+	}
+	item, err := s.store.Publish(r.Context(), input)
+	if err == nil {
+		s.metrics.PublishAccepted()
+	}
+	s.respond(w, item, err, http.StatusAccepted)
+}
+
+func (s *Server) rollback(w http.ResponseWriter, r *http.Request) {
+	var input domain.RollbackRequest
+	if !decode(w, r, &input) {
+		return
+	}
+	input.Operator = actor(r)
+	if input.AppID <= 0 || input.NamespaceID <= 0 || input.EnvironmentID <= 0 || input.TargetVersion <= 0 {
+		writeError(w, http.StatusBadRequest, "invalid_argument", "回滚范围或目标版本不正确")
+		return
+	}
+	if !s.requireApp(w, r, input.AppID, authpkg.RoleAppOwner) {
+		return
+	}
+	item, err := s.store.Rollback(r.Context(), input)
+	s.respond(w, item, err, http.StatusAccepted)
+}
+
+func (s *Server) listReleases(w http.ResponseWriter, r *http.Request) {
+	appID, namespaceID, envID, ok := scopeIDs(w, r)
+	if !ok {
+		return
+	}
+	if !s.requireApp(w, r, appID, authpkg.RoleViewer) {
+		return
+	}
+	items, err := s.store.ListReleases(r.Context(), appID, namespaceID, envID)
+	s.respond(w, items, err, http.StatusOK)
+}
+
+func (s *Server) getRelease(w http.ResponseWriter, r *http.Request) {
+	id, ok := pathID(w, r)
+	if !ok {
+		return
+	}
+	item, err := s.store.GetRelease(r.Context(), id)
+	if err == nil && !s.requireApp(w, r, item.AppID, authpkg.RoleViewer) {
+		return
+	}
+	s.respond(w, item, err, http.StatusOK)
+}
+
+func (s *Server) listAuditLogs(w http.ResponseWriter, r *http.Request) {
+	if !s.requireAdmin(w, r) {
+		return
+	}
+	limit, _ := strconv.Atoi(r.URL.Query().Get("limit"))
+	items, err := s.store.ListAuditLogs(r.Context(), limit)
+	s.respond(w, items, err, http.StatusOK)
+}
+
+func (s *Server) listGrayRules(w http.ResponseWriter, r *http.Request) {
+	appID, namespaceID, envID, ok := scopeIDs(w, r)
+	if !ok {
+		return
+	}
+	if !s.requireApp(w, r, appID, authpkg.RoleViewer) {
+		return
+	}
+	items, err := s.store.ListGrayRules(r.Context(), appID, namespaceID, envID)
+	s.respond(w, items, err, http.StatusOK)
+}
+
+func (s *Server) createGrayRule(w http.ResponseWriter, r *http.Request) {
+	var input domain.GrayRule
+	if !decode(w, r, &input) {
+		return
+	}
+	if !s.requireApp(w, r, input.AppID, authpkg.RoleAppOwner) {
+		return
+	}
+	if err := gray.Validate(input); err != nil {
+		writeError(w, http.StatusBadRequest, "invalid_gray_rule", err.Error())
+		return
+	}
+	item, err := s.store.CreateGrayRule(r.Context(), input, actor(r))
+	s.respond(w, item, err, http.StatusCreated)
+}
+
+func (s *Server) updateGrayRule(w http.ResponseWriter, r *http.Request) {
+	id, ok := pathID(w, r)
+	if !ok {
+		return
+	}
+	current, err := s.store.GetGrayRule(r.Context(), id)
+	if err != nil {
+		s.respond(w, nil, err, http.StatusOK)
+		return
+	}
+	if !s.requireApp(w, r, current.AppID, authpkg.RoleAppOwner) {
+		return
+	}
+	var input domain.GrayRule
+	if !decode(w, r, &input) {
+		return
+	}
+	input.AppID, input.NamespaceID, input.EnvironmentID = current.AppID, current.NamespaceID, current.EnvironmentID
+	if err := gray.Validate(input); err != nil {
+		writeError(w, http.StatusBadRequest, "invalid_gray_rule", err.Error())
+		return
+	}
+	item, err := s.store.UpdateGrayRule(r.Context(), id, input, actor(r))
+	s.respond(w, item, err, http.StatusOK)
+}
+
+func (s *Server) deleteGrayRule(w http.ResponseWriter, r *http.Request) {
+	id, ok := pathID(w, r)
+	if !ok {
+		return
+	}
+	current, err := s.store.GetGrayRule(r.Context(), id)
+	if err != nil {
+		s.respond(w, nil, err, http.StatusOK)
+		return
+	}
+	if !s.requireApp(w, r, current.AppID, authpkg.RoleAppOwner) {
+		return
+	}
+	s.respondEmpty(w, s.store.DeleteGrayRule(r.Context(), id, actor(r)))
+}
+
+func (s *Server) getRuntimeConfig(w http.ResponseWriter, r *http.Request) {
+	key, ok := runtimeKey(w, r)
+	if !ok {
+		return
+	}
+	appID, namespaceID, envID, err := s.store.ResolveScope(r.Context(), r.URL.Query().Get("env"), r.URL.Query().Get("app"), r.URL.Query().Get("namespace"))
+	if err != nil {
+		s.respond(w, nil, err, http.StatusOK)
+		return
+	}
+	if !s.requireApp(w, r, appID, authpkg.RoleViewer) {
+		return
+	}
+	item, err := s.runtime.Get(r.Context(), key)
+	if err == nil {
+		rules, listErr := s.store.ListGrayRules(r.Context(), appID, namespaceID, envID)
+		if listErr != nil {
+			err = listErr
+		} else {
+			item.Items, item.GrayRuleIDs = gray.Apply(item.Items, rules, grayTarget(r))
+			s.metrics.RuntimeRead()
+			s.metrics.GrayMatched(len(item.GrayRuleIDs))
+		}
+	}
+	s.respond(w, item, err, http.StatusOK)
+}
+
+func (s *Server) watchRuntimeConfig(w http.ResponseWriter, r *http.Request) {
+	key, ok := runtimeKey(w, r)
+	if !ok {
+		return
+	}
+	appID, namespaceID, envID, err := s.store.ResolveScope(r.Context(), r.URL.Query().Get("env"), r.URL.Query().Get("app"), r.URL.Query().Get("namespace"))
+	if err != nil {
+		s.respond(w, nil, err, http.StatusOK)
+		return
+	}
+	if !s.requireApp(w, r, appID, authpkg.RoleViewer) {
+		return
+	}
+	flusher, ok := w.(http.Flusher)
+	if !ok {
+		writeError(w, http.StatusInternalServerError, "stream_unsupported", "当前服务器不支持流式响应")
+		return
+	}
+	events, unsubscribe := s.hub.Subscribe(key)
+	s.metrics.WatcherAdded()
+	defer func() {
+		unsubscribe()
+		s.metrics.WatcherRemoved()
+	}()
+	current, err := s.runtime.Get(r.Context(), key)
+	if err != nil {
+		s.respond(w, nil, err, http.StatusOK)
+		return
+	}
+	rules, err := s.store.ListGrayRules(r.Context(), appID, namespaceID, envID)
+	if err != nil {
+		s.respond(w, nil, err, http.StatusOK)
+		return
+	}
+	current.Items, current.GrayRuleIDs = gray.Apply(current.Items, rules, grayTarget(r))
+	s.metrics.GrayMatched(len(current.GrayRuleIDs))
+	w.Header().Set("Content-Type", "text/event-stream")
+	w.Header().Set("Cache-Control", "no-cache, no-transform")
+	w.Header().Set("Connection", "keep-alive")
+	w.Header().Set("X-Accel-Buffering", "no")
+	initial := domain.ConfigEvent{Type: "FULL_SYNC", Items: current.Items, Revision: current.Revision, GrayRuleIDs: current.GrayRuleIDs}
+	if err := writeSSE(w, initial); err != nil {
+		return
+	}
+	flusher.Flush()
+	heartbeat := time.NewTicker(15 * time.Second)
+	defer heartbeat.Stop()
+	for {
+		select {
+		case <-r.Context().Done():
+			return
+		case event, open := <-events:
+			if !open {
+				return
+			}
+			if event.Revision <= current.Revision {
+				continue
+			}
+			rules, err := s.store.ListGrayRules(r.Context(), appID, namespaceID, envID)
+			if err != nil {
+				return
+			}
+			event.Items, event.GrayRuleIDs = gray.Apply(event.Items, rules, grayTarget(r))
+			s.metrics.GrayMatched(len(event.GrayRuleIDs))
+			if err := writeSSE(w, event); err != nil {
+				return
+			}
+			flusher.Flush()
+		case <-heartbeat.C:
+			if _, err := fmt.Fprint(w, ": heartbeat\n\n"); err != nil {
+				return
+			}
+			flusher.Flush()
+		}
+	}
+}
+
+func grayTarget(r *http.Request) gray.Target {
+	return gray.Target{IP: strings.TrimSpace(r.URL.Query().Get("ip")), Instance: strings.TrimSpace(r.URL.Query().Get("instance"))}
+}
+
+func (s *Server) respond(w http.ResponseWriter, data any, err error, successStatus int) {
+	if err == nil {
+		writeJSON(w, successStatus, responseEnvelope{Data: data})
+		return
+	}
+	s.writeStoreError(w, err)
+}
+
+func (s *Server) respondEmpty(w http.ResponseWriter, err error) {
+	if err == nil {
+		w.WriteHeader(http.StatusNoContent)
+		return
+	}
+	s.writeStoreError(w, err)
+}
+
+func (s *Server) writeStoreError(w http.ResponseWriter, err error) {
+	switch {
+	case errors.Is(err, store.ErrNotFound):
+		writeError(w, http.StatusNotFound, "not_found", "资源不存在")
+	case errors.Is(err, store.ErrConflict):
+		writeError(w, http.StatusConflict, "conflict", "资源已存在")
+	case errors.Is(err, store.ErrNoPendingChange):
+		writeError(w, http.StatusConflict, "no_pending_changes", "没有待发布的配置变更")
+	case errors.Is(err, store.ErrInvalidRollback):
+		writeError(w, http.StatusConflict, "invalid_rollback", "不能回滚到当前最新版本")
+	default:
+		s.logger.Error("api request failed", "error", err)
+		writeError(w, http.StatusInternalServerError, "internal", "服务器内部错误")
+	}
+}
+
+func (s *Server) writeAuthError(w http.ResponseWriter, err error) {
+	if errors.Is(err, authpkg.ErrForbidden) {
+		writeError(w, http.StatusForbidden, "forbidden", "没有执行该操作的权限")
+		return
+	}
+	writeError(w, http.StatusUnauthorized, "unauthorized", "登录状态无效或已过期")
+}
+
+func (s *Server) requireAdmin(w http.ResponseWriter, r *http.Request) bool {
+	if err := s.authorizer.RequireAdmin(r.Context()); err != nil {
+		s.writeAuthError(w, err)
+		return false
+	}
+	return true
+}
+
+func (s *Server) requireApp(w http.ResponseWriter, r *http.Request, appID int64, role string) bool {
+	if err := s.authorizer.RequireAppRole(r.Context(), appID, role); err != nil {
+		if errors.Is(err, authpkg.ErrUnauthorized) || errors.Is(err, authpkg.ErrForbidden) {
+			s.writeAuthError(w, err)
+		} else {
+			s.respond(w, nil, err, http.StatusOK)
+		}
+		return false
+	}
+	return true
+}
+
+func (s *Server) authenticate(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method == http.MethodOptions || r.URL.Path == "/v1/auth/login" || strings.HasPrefix(r.URL.Path, "/health/") || r.URL.Path == "/metrics" {
+			next.ServeHTTP(w, r)
+			return
+		}
+		principal, err := s.authorizer.AuthenticateRequest(r)
+		if err != nil {
+			s.writeAuthError(w, err)
+			return
+		}
+		if !s.authorizer.Enabled() {
+			if value := strings.TrimSpace(r.Header.Get("X-User")); value != "" && len(value) <= 64 {
+				principal.Username, principal.DisplayName = value, value
+			}
+		}
+		next.ServeHTTP(w, r.WithContext(authpkg.WithPrincipal(r.Context(), principal)))
+	})
+}
+
+func (s *Server) cors(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		origin := r.Header.Get("Origin")
+		if origin != "" {
+			if _, allowed := s.allowedOrigins[origin]; allowed {
+				w.Header().Set("Access-Control-Allow-Origin", origin)
+				w.Header().Set("Vary", "Origin")
+				w.Header().Set("Access-Control-Allow-Headers", "Authorization, Content-Type, X-User")
+				w.Header().Set("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS")
+			}
+		}
+		if r.Method == http.MethodOptions {
+			w.WriteHeader(http.StatusNoContent)
+			return
+		}
+		next.ServeHTTP(w, r)
+	})
+}
+
+func (s *Server) log(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		start := time.Now()
+		wrapped := &statusWriter{ResponseWriter: w, status: http.StatusOK}
+		next.ServeHTTP(wrapped, r)
+		s.metrics.ObserveHTTP(r.Method, r.Pattern, wrapped.status, time.Since(start))
+		s.logger.Info("http request", "method", r.Method, "path", r.URL.Path, "status", wrapped.status, "duration_ms", time.Since(start).Milliseconds())
+	})
+}
+
+func (s *Server) recover(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		defer func() {
+			if value := recover(); value != nil {
+				s.logger.Error("panic serving request", "panic", value)
+				writeError(w, http.StatusInternalServerError, "internal", "服务器内部错误")
+			}
+		}()
+		next.ServeHTTP(w, r)
+	})
+}
+
+type statusWriter struct {
+	http.ResponseWriter
+	status int
+}
+
+func (w *statusWriter) WriteHeader(status int) {
+	w.status = status
+	w.ResponseWriter.WriteHeader(status)
+}
+
+func (w *statusWriter) Flush() {
+	if flusher, ok := w.ResponseWriter.(http.Flusher); ok {
+		flusher.Flush()
+	}
+}
+
+func decode(w http.ResponseWriter, r *http.Request, target any) bool {
+	r.Body = http.MaxBytesReader(w, r.Body, 1<<20)
+	decoder := json.NewDecoder(r.Body)
+	decoder.DisallowUnknownFields()
+	if err := decoder.Decode(target); err != nil {
+		writeError(w, http.StatusBadRequest, "invalid_json", "请求 JSON 格式不正确")
+		return false
+	}
+	if decoder.Decode(&struct{}{}) == nil {
+		writeError(w, http.StatusBadRequest, "invalid_json", "请求只能包含一个 JSON 对象")
+		return false
+	}
+	return true
+}
+
+func pathID(w http.ResponseWriter, r *http.Request) (int64, bool) {
+	id, err := strconv.ParseInt(r.PathValue("id"), 10, 64)
+	if err != nil || id <= 0 {
+		writeError(w, http.StatusBadRequest, "invalid_argument", "资源 ID 格式不正确")
+		return 0, false
+	}
+	return id, true
+}
+
+func rolePathIDs(w http.ResponseWriter, r *http.Request) (int64, int64, bool) {
+	userID, err := strconv.ParseInt(r.PathValue("id"), 10, 64)
+	if err != nil || userID <= 0 {
+		writeError(w, http.StatusBadRequest, "invalid_argument", "用户 ID 格式不正确")
+		return 0, 0, false
+	}
+	appID, err := strconv.ParseInt(r.PathValue("appId"), 10, 64)
+	if err != nil || appID <= 0 {
+		writeError(w, http.StatusBadRequest, "invalid_argument", "应用 ID 格式不正确")
+		return 0, 0, false
+	}
+	return userID, appID, true
+}
+
+func scopeIDs(w http.ResponseWriter, r *http.Request) (int64, int64, int64, bool) {
+	values := []string{r.URL.Query().Get("appId"), r.URL.Query().Get("nsId"), r.URL.Query().Get("envId")}
+	ids := make([]int64, 3)
+	for i, value := range values {
+		parsed, err := strconv.ParseInt(value, 10, 64)
+		if err != nil || parsed <= 0 {
+			writeError(w, http.StatusBadRequest, "invalid_argument", "appId、nsId 和 envId 必须是正整数")
+			return 0, 0, 0, false
+		}
+		ids[i] = parsed
+	}
+	return ids[0], ids[1], ids[2], true
+}
+
+func runtimeKey(w http.ResponseWriter, r *http.Request) (string, bool) {
+	env := strings.ToLower(strings.TrimSpace(r.URL.Query().Get("env")))
+	app := strings.TrimSpace(r.URL.Query().Get("app"))
+	namespace := strings.TrimSpace(r.URL.Query().Get("namespace"))
+	if !validCode(env) || !validCode(app) || !validCode(namespace) {
+		writeError(w, http.StatusBadRequest, "invalid_argument", "env、app 和 namespace 格式不正确")
+		return "", false
+	}
+	return fmt.Sprintf("/config/%s/%s/%s", env, app, namespace), true
+}
+
+func validCode(value string) bool {
+	if value == "" || len(value) > 64 {
+		return false
+	}
+	for _, r := range value {
+		if unicode.IsLetter(r) || unicode.IsDigit(r) || r == '-' || r == '_' || r == '.' {
+			continue
+		}
+		return false
+	}
+	return true
+}
+
+func validConfigKey(value string) bool {
+	value = strings.TrimSpace(value)
+	return value != "" && len(value) <= 256 && !strings.ContainsAny(value, "\r\n\x00")
+}
+
+func validFormat(value string) bool {
+	switch value {
+	case "properties", "yaml", "json", "xml":
+		return true
+	default:
+		return false
+	}
+}
+
+func actor(r *http.Request) string {
+	if principal, ok := authpkg.Principal(r.Context()); ok && principal.Username != "" {
+		return principal.Username
+	}
+	return "admin"
+}
+
+func writeSSE(w http.ResponseWriter, event domain.ConfigEvent) error {
+	payload, err := json.Marshal(event)
+	if err != nil {
+		return err
+	}
+	_, err = fmt.Fprintf(w, "id: %d\nevent: config\ndata: %s\n\n", event.Revision, payload)
+	return err
+}
+
+func writeJSON(w http.ResponseWriter, status int, value any) {
+	w.Header().Set("Content-Type", "application/json; charset=utf-8")
+	w.WriteHeader(status)
+	_ = json.NewEncoder(w).Encode(value)
+}
+
+func writeError(w http.ResponseWriter, status int, code, message string) {
+	writeJSON(w, status, errorEnvelope{Error: apiError{Code: code, Message: message}})
+}
diff --git a/internal/api/httpapi/server_test.go b/internal/api/httpapi/server_test.go
new file mode 100644
index 0000000..38d7d17
--- /dev/null
+++ b/internal/api/httpapi/server_test.go
@@ -0,0 +1,232 @@
+package httpapi_test
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/longpeng/configcenter/internal/api/httpapi"
+	"github.com/longpeng/configcenter/internal/auth"
+	"github.com/longpeng/configcenter/internal/domain"
+	"github.com/longpeng/configcenter/internal/metrics"
+	"github.com/longpeng/configcenter/internal/outbox"
+	memoryruntime "github.com/longpeng/configcenter/internal/runtime/memory"
+	memory_store "github.com/longpeng/configcenter/internal/store/memory"
+	"github.com/longpeng/configcenter/internal/watch"
+)
+
+func TestCRUDPublishAndRuntimeRead(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	repository := memory_store.New(false)
+	runtimeStore := memoryruntime.New()
+	defer runtimeStore.Close() //nolint:errcheck
+	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
+	hub := watch.New(ctx, runtimeStore)
+	authorizer, err := auth.New(repository, false, "", 8*time.Hour)
+	if err != nil {
+		t.Fatal(err)
+	}
+	collector := metrics.New()
+	worker := outbox.New(repository, runtimeStore, time.Millisecond, 10, 3, collector, logger)
+	go worker.Run(ctx)
+	handler := httpapi.New(repository, runtimeStore, hub, authorizer, collector, nil, logger).Handler()
+
+	var app domain.Application
+	post(t, handler, "/v1/applications", map[string]any{"code": "orders", "name": "Orders"}, http.StatusCreated, &app)
+	var env domain.Environment
+	post(t, handler, "/v1/environments", map[string]any{"code": "PROD", "name": "Production", "order": 1}, http.StatusCreated, &env)
+	var namespace domain.Namespace
+	post(t, handler, "/v1/namespaces", map[string]any{"appId": app.ID, "name": "application", "type": "properties"}, http.StatusCreated, &namespace)
+	var config domain.ConfigItem
+	post(t, handler, "/v1/config-items", map[string]any{
+		"appId": app.ID, "nsId": namespace.ID, "envId": env.ID, "key": "server.port", "value": "8080",
+	}, http.StatusCreated, &config)
+
+	var release domain.Release
+	post(t, handler, "/v1/publish", map[string]any{
+		"appId": app.ID, "nsId": namespace.ID, "envId": env.ID, "comment": "first release",
+	}, http.StatusAccepted, &release)
+	if release.Status != "pending" || release.Version != 1 {
+		t.Fatalf("unexpected accepted release: %#v", release)
+	}
+
+	deadline := time.Now().Add(time.Second)
+	for time.Now().Before(deadline) {
+		get(t, handler, fmt.Sprintf("/v1/releases/%d", release.ID), http.StatusOK, &release)
+		if release.Status == "applied" {
+			break
+		}
+		time.Sleep(5 * time.Millisecond)
+	}
+	if release.Status != "applied" || release.EtcdRevision == nil {
+		t.Fatalf("outbox was not applied: %#v", release)
+	}
+
+	var current domain.RuntimeConfig
+	get(t, handler, "/v1/config?env=PROD&app=orders&namespace=application", http.StatusOK, &current)
+	if current.Items["server.port"] != "8080" || current.ReleaseVersion != 1 {
+		t.Fatalf("unexpected runtime config: %#v", current)
+	}
+
+	var grayRule domain.GrayRule
+	post(t, handler, "/v1/gray-rules", map[string]any{
+		"appId": app.ID, "nsId": namespace.ID, "envId": env.ID,
+		"ruleType": "instance", "ruleValue": map[string]any{"instances": []string{"orders-7"}},
+		"overrides": map[string]string{"server.port": "9080", "feature.gray": "on"}, "enabled": true, "priority": 10,
+	}, http.StatusCreated, &grayRule)
+	get(t, handler, "/v1/config?env=PROD&app=orders&namespace=application&instance=orders-7", http.StatusOK, &current)
+	if current.Items["server.port"] != "9080" || current.Items["feature.gray"] != "on" || len(current.GrayRuleIDs) != 1 || current.GrayRuleIDs[0] != grayRule.ID {
+		t.Fatalf("gray overrides were not applied: %#v", current)
+	}
+}
+
+func TestAuthenticationRBACAndMetrics(t *testing.T) {
+	ctx := context.Background()
+	repository := memory_store.New(false)
+	runtimeStore := memoryruntime.New()
+	defer runtimeStore.Close() //nolint:errcheck
+	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
+	authorizer, err := auth.New(repository, true, "0123456789abcdef0123456789abcdef", 90*time.Minute)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := authorizer.Bootstrap(ctx, "root", "a-strong-password", "Root Admin"); err != nil {
+		t.Fatal(err)
+	}
+	collector := metrics.New()
+	handler := httpapi.New(repository, runtimeStore, watch.New(ctx, runtimeStore), authorizer, collector, nil, logger).Handler()
+
+	request := httptest.NewRequest(http.MethodGet, "/v1/applications", nil)
+	doStatus(t, handler, request, http.StatusUnauthorized)
+
+	var adminLogin struct {
+		Token     string `json:"token"`
+		ExpiresIn int64  `json:"expiresIn"`
+	}
+	requestJSON(t, handler, http.MethodPost, "/v1/auth/login", "", map[string]any{"username": "root", "password": "a-strong-password"}, http.StatusOK, &adminLogin)
+	if adminLogin.Token == "" || adminLogin.ExpiresIn != 5400 {
+		t.Fatalf("unexpected login response: %#v", adminLogin)
+	}
+
+	var application domain.Application
+	requestJSON(t, handler, http.MethodPost, "/v1/applications", adminLogin.Token, map[string]any{"code": "secure-app", "name": "Secure App"}, http.StatusCreated, &application)
+	var viewer domain.User
+	requestJSON(t, handler, http.MethodPost, "/v1/users", adminLogin.Token, map[string]any{
+		"username": "reader", "displayName": "Read Only", "password": "reader-password-123",
+	}, http.StatusCreated, &viewer)
+	requestJSON(t, handler, http.MethodPut, fmt.Sprintf("/v1/users/%d/roles/%d", viewer.ID, application.ID), adminLogin.Token, map[string]any{"role": auth.RoleViewer}, http.StatusOK, &domain.UserAppRole{})
+	var audits []domain.AuditLog
+	requestJSON(t, handler, http.MethodGet, "/v1/audit-logs?limit=20", adminLogin.Token, nil, http.StatusOK, &audits)
+	foundActor := false
+	for _, audit := range audits {
+		if audit.Actor == "root" && audit.TargetType == "app" && audit.Action == "create" {
+			foundActor = true
+			break
+		}
+	}
+	if !foundActor {
+		t.Fatalf("JWT actor was not propagated to audit log: %#v", audits)
+	}
+
+	var viewerLogin struct {
+		Token string `json:"token"`
+	}
+	requestJSON(t, handler, http.MethodPost, "/v1/auth/login", "", map[string]any{"username": "reader", "password": "reader-password-123"}, http.StatusOK, &viewerLogin)
+	var applications []domain.Application
+	requestJSON(t, handler, http.MethodGet, "/v1/applications", viewerLogin.Token, nil, http.StatusOK, &applications)
+	if len(applications) != 1 || applications[0].ID != application.ID {
+		t.Fatalf("viewer application filtering failed: %#v", applications)
+	}
+	requestJSON(t, handler, http.MethodPost, "/v1/namespaces", viewerLogin.Token, map[string]any{"appId": application.ID, "name": "application", "type": "properties"}, http.StatusForbidden, nil)
+
+	doStatus(t, handler, httptest.NewRequest(http.MethodGet, "/health/live", nil), http.StatusOK)
+	recorder := httptest.NewRecorder()
+	handler.ServeHTTP(recorder, httptest.NewRequest(http.MethodGet, "/metrics", nil))
+	if recorder.Code != http.StatusOK || !strings.Contains(recorder.Body.String(), `configcenter_http_requests_total{method="GET",route="GET /health/live",status="200"}`) || !strings.Contains(recorder.Body.String(), "configcenter_outbox_pending 0") {
+		t.Fatalf("unexpected metrics response: status=%d body=%s", recorder.Code, recorder.Body.String())
+	}
+}
+
+func post(t *testing.T, handler http.Handler, path string, input any, wantStatus int, output any) {
+	t.Helper()
+	payload, err := json.Marshal(input)
+	if err != nil {
+		t.Fatal(err)
+	}
+	request := httptest.NewRequest(http.MethodPost, path, bytes.NewReader(payload))
+	request.Header.Set("Content-Type", "application/json")
+	request.Header.Set("X-User", "tester")
+	do(t, handler, request, wantStatus, output)
+}
+
+func get(t *testing.T, handler http.Handler, path string, wantStatus int, output any) {
+	t.Helper()
+	request := httptest.NewRequest(http.MethodGet, path, nil)
+	do(t, handler, request, wantStatus, output)
+}
+
+func do(t *testing.T, handler http.Handler, request *http.Request, wantStatus int, output any) {
+	t.Helper()
+	recorder := httptest.NewRecorder()
+	handler.ServeHTTP(recorder, request)
+	response := recorder.Result()
+	defer response.Body.Close()
+	body, err := io.ReadAll(response.Body)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if response.StatusCode != wantStatus {
+		t.Fatalf("%s %s: got status %d, want %d; body=%s", request.Method, request.URL, response.StatusCode, wantStatus, body)
+	}
+	var envelope struct {
+		Data json.RawMessage `json:"data"`
+	}
+	if err := json.Unmarshal(body, &envelope); err != nil {
+		t.Fatalf("decode response envelope: %v; body=%s", err, body)
+	}
+	if err := json.Unmarshal(envelope.Data, output); err != nil {
+		t.Fatalf("decode response data: %v; body=%s", err, body)
+	}
+}
+
+func requestJSON(t *testing.T, handler http.Handler, method, path, token string, input any, wantStatus int, output any) {
+	t.Helper()
+	var body io.Reader
+	if input != nil {
+		payload, err := json.Marshal(input)
+		if err != nil {
+			t.Fatal(err)
+		}
+		body = bytes.NewReader(payload)
+	}
+	request := httptest.NewRequest(method, path, body)
+	if input != nil {
+		request.Header.Set("Content-Type", "application/json")
+	}
+	if token != "" {
+		request.Header.Set("Authorization", "Bearer "+token)
+	}
+	if output == nil {
+		doStatus(t, handler, request, wantStatus)
+		return
+	}
+	do(t, handler, request, wantStatus, output)
+}
+
+func doStatus(t *testing.T, handler http.Handler, request *http.Request, wantStatus int) {
+	t.Helper()
+	recorder := httptest.NewRecorder()
+	handler.ServeHTTP(recorder, request)
+	if recorder.Code != wantStatus {
+		t.Fatalf("%s %s: got status %d, want %d; body=%s", request.Method, request.URL, recorder.Code, wantStatus, recorder.Body.String())
+	}
+}
diff --git a/internal/auth/auth.go b/internal/auth/auth.go
new file mode 100644
index 0000000..646c77d
--- /dev/null
+++ b/internal/auth/auth.go
@@ -0,0 +1,224 @@
+package auth
+
+import (
+	"context"
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"strings"
+	"time"
+
+	"golang.org/x/crypto/bcrypt"
+
+	"github.com/longpeng/configcenter/internal/domain"
+	"github.com/longpeng/configcenter/internal/store"
+)
+
+var (
+	ErrUnauthorized = errors.New("authentication required")
+	ErrForbidden    = errors.New("permission denied")
+)
+
+const (
+	RoleViewer   = "viewer"
+	RoleAppOwner = "app-owner"
+	RoleAdmin    = "admin"
+)
+
+type Manager struct {
+	enabled bool
+	secret  []byte
+	ttl     time.Duration
+	store   store.Store
+	now     func() time.Time
+}
+
+type tokenClaims struct {
+	Issuer      string `json:"iss"`
+	Subject     string `json:"sub"`
+	UserID      int64  `json:"uid"`
+	DisplayName string `json:"name"`
+	Admin       bool   `json:"admin"`
+	IssuedAt    int64  `json:"iat"`
+	ExpiresAt   int64  `json:"exp"`
+}
+
+type principalKey struct{}
+
+func New(repository store.Store, enabled bool, secret string, ttl time.Duration) (*Manager, error) {
+	if enabled && len(secret) < 32 {
+		return nil, errors.New("JWT_SECRET must contain at least 32 characters when authentication is enabled")
+	}
+	if ttl <= 0 {
+		return nil, errors.New("JWT_TTL must be positive")
+	}
+	return &Manager{enabled: enabled, secret: []byte(secret), ttl: ttl, store: repository, now: time.Now}, nil
+}
+
+func (m *Manager) Enabled() bool { return m.enabled }
+
+func (m *Manager) TTLSeconds() int64 { return int64(m.ttl.Seconds()) }
+
+func (m *Manager) Bootstrap(ctx context.Context, username, password, displayName string) error {
+	if !m.enabled {
+		return nil
+	}
+	if strings.TrimSpace(username) == "" || len(password) < 12 {
+		return errors.New("bootstrap admin username is required and password must contain at least 12 characters")
+	}
+	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
+	if err != nil {
+		return fmt.Errorf("hash bootstrap password: %w", err)
+	}
+	return m.store.EnsureBootstrapAdmin(ctx, normalizeUsername(username), string(hash), strings.TrimSpace(displayName))
+}
+
+func (m *Manager) Login(ctx context.Context, username, password string) (string, domain.Principal, error) {
+	if !m.enabled {
+		principal := domain.Principal{Username: "admin", DisplayName: "Development Admin", IsAdmin: true}
+		token, err := m.issue(principal)
+		return token, principal, err
+	}
+	credential, err := m.store.FindUserByUsername(ctx, normalizeUsername(username))
+	if err != nil || credential.Disabled || bcrypt.CompareHashAndPassword([]byte(credential.PasswordHash), []byte(password)) != nil {
+		return "", domain.Principal{}, ErrUnauthorized
+	}
+	principal := domain.Principal{UserID: credential.ID, Username: credential.Username, DisplayName: credential.DisplayName, IsAdmin: credential.IsAdmin}
+	token, err := m.issue(principal)
+	return token, principal, err
+}
+
+func (m *Manager) CreateUser(ctx context.Context, input domain.User, password string) (domain.User, error) {
+	if len(password) < 12 {
+		return domain.User{}, errors.New("password must contain at least 12 characters")
+	}
+	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
+	if err != nil {
+		return domain.User{}, err
+	}
+	input.Username = normalizeUsername(input.Username)
+	return m.store.CreateUser(ctx, input, string(hash))
+}
+
+func (m *Manager) AuthenticateRequest(r *http.Request) (domain.Principal, error) {
+	if !m.enabled {
+		return domain.Principal{Username: "admin", DisplayName: "Development Admin", IsAdmin: true}, nil
+	}
+	header := strings.TrimSpace(r.Header.Get("Authorization"))
+	if !strings.HasPrefix(header, "Bearer ") {
+		return domain.Principal{}, ErrUnauthorized
+	}
+	return m.parse(strings.TrimSpace(strings.TrimPrefix(header, "Bearer ")))
+}
+
+func WithPrincipal(ctx context.Context, principal domain.Principal) context.Context {
+	return context.WithValue(ctx, principalKey{}, principal)
+}
+
+func Principal(ctx context.Context) (domain.Principal, bool) {
+	principal, ok := ctx.Value(principalKey{}).(domain.Principal)
+	return principal, ok
+}
+
+func (m *Manager) RequireAdmin(ctx context.Context) error {
+	principal, ok := Principal(ctx)
+	if !ok {
+		return ErrUnauthorized
+	}
+	if !principal.IsAdmin {
+		return ErrForbidden
+	}
+	return nil
+}
+
+func (m *Manager) RequireAppRole(ctx context.Context, appID int64, minimum string) error {
+	principal, ok := Principal(ctx)
+	if !ok {
+		return ErrUnauthorized
+	}
+	if principal.IsAdmin {
+		return nil
+	}
+	role, err := m.store.GetUserAppRole(ctx, principal.UserID, appID)
+	if err != nil {
+		if errors.Is(err, store.ErrNotFound) {
+			return ErrForbidden
+		}
+		return err
+	}
+	if roleRank(role) < roleRank(minimum) {
+		return ErrForbidden
+	}
+	return nil
+}
+
+func (m *Manager) CanAccessApp(ctx context.Context, appID int64, minimum string) bool {
+	return m.RequireAppRole(ctx, appID, minimum) == nil
+}
+
+func (m *Manager) issue(principal domain.Principal) (string, error) {
+	now := m.now().UTC()
+	claims := tokenClaims{Issuer: "configcenter", Subject: principal.Username, UserID: principal.UserID, DisplayName: principal.DisplayName, Admin: principal.IsAdmin, IssuedAt: now.Unix(), ExpiresAt: now.Add(m.ttl).Unix()}
+	header, _ := json.Marshal(map[string]string{"alg": "HS256", "typ": "JWT"})
+	payload, err := json.Marshal(claims)
+	if err != nil {
+		return "", err
+	}
+	unsigned := encode(header) + "." + encode(payload)
+	signature := m.sign(unsigned)
+	return unsigned + "." + encode(signature), nil
+}
+
+func (m *Manager) parse(token string) (domain.Principal, error) {
+	parts := strings.Split(token, ".")
+	if len(parts) != 3 {
+		return domain.Principal{}, ErrUnauthorized
+	}
+	unsigned := parts[0] + "." + parts[1]
+	signature, err := base64.RawURLEncoding.DecodeString(parts[2])
+	if err != nil || !hmac.Equal(signature, m.sign(unsigned)) {
+		return domain.Principal{}, ErrUnauthorized
+	}
+	payload, err := base64.RawURLEncoding.DecodeString(parts[1])
+	if err != nil {
+		return domain.Principal{}, ErrUnauthorized
+	}
+	var claims tokenClaims
+	if err := json.Unmarshal(payload, &claims); err != nil || claims.Issuer != "configcenter" || claims.Subject == "" {
+		return domain.Principal{}, ErrUnauthorized
+	}
+	now := m.now().Unix()
+	if claims.ExpiresAt <= now || claims.IssuedAt > now+60 {
+		return domain.Principal{}, ErrUnauthorized
+	}
+	return domain.Principal{UserID: claims.UserID, Username: claims.Subject, DisplayName: claims.DisplayName, IsAdmin: claims.Admin}, nil
+}
+
+func (m *Manager) sign(input string) []byte {
+	mac := hmac.New(sha256.New, m.secret)
+	_, _ = mac.Write([]byte(input))
+	return mac.Sum(nil)
+}
+
+func encode(value []byte) string { return base64.RawURLEncoding.EncodeToString(value) }
+
+func normalizeUsername(value string) string { return strings.ToLower(strings.TrimSpace(value)) }
+
+func roleRank(role string) int {
+	switch role {
+	case RoleViewer:
+		return 1
+	case RoleAppOwner:
+		return 2
+	case RoleAdmin:
+		return 3
+	default:
+		return 0
+	}
+}
+
+func ValidRole(role string) bool { return roleRank(role) > 0 }
diff --git a/internal/auth/auth_test.go b/internal/auth/auth_test.go
new file mode 100644
index 0000000..5d259da
--- /dev/null
+++ b/internal/auth/auth_test.go
@@ -0,0 +1,72 @@
+package auth
+
+import (
+	"context"
+	"errors"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/longpeng/configcenter/internal/domain"
+	memory_store "github.com/longpeng/configcenter/internal/store/memory"
+)
+
+func TestLoginTokenExpiryAndApplicationRoles(t *testing.T) {
+	ctx := context.Background()
+	repository := memory_store.New(false)
+	manager, err := New(repository, true, "0123456789abcdef0123456789abcdef", time.Hour)
+	if err != nil {
+		t.Fatal(err)
+	}
+	clock := time.Date(2026, 8, 30, 2, 0, 0, 0, time.UTC)
+	manager.now = func() time.Time { return clock }
+	if err := manager.Bootstrap(ctx, "root", "a-strong-password", "Root"); err != nil {
+		t.Fatal(err)
+	}
+	token, principal, err := manager.Login(ctx, "root", "a-strong-password")
+	if err != nil || !principal.IsAdmin {
+		t.Fatalf("bootstrap login failed: principal=%#v err=%v", principal, err)
+	}
+	request := httptest.NewRequest("GET", "/v1/applications", nil)
+	request.Header.Set("Authorization", "Bearer "+token)
+	parsed, err := manager.AuthenticateRequest(request)
+	if err != nil || parsed.Username != "root" {
+		t.Fatalf("token validation failed: principal=%#v err=%v", parsed, err)
+	}
+
+	app, err := repository.CreateApplication(ctx, domain.Application{Code: "orders", Name: "Orders"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	viewer, err := manager.CreateUser(ctx, domain.User{Username: "Reader", DisplayName: "Reader"}, "another-strong-password")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if viewer.Username != "reader" {
+		t.Fatalf("username was not normalized: %q", viewer.Username)
+	}
+	if err := repository.SetUserAppRole(ctx, domain.UserAppRole{UserID: viewer.ID, AppID: app.ID, Role: RoleViewer}); err != nil {
+		t.Fatal(err)
+	}
+	viewerToken, viewerPrincipal, err := manager.Login(ctx, "READER", "another-strong-password")
+	if err != nil || viewerToken == "" {
+		t.Fatal(err)
+	}
+	viewerContext := WithPrincipal(ctx, viewerPrincipal)
+	if err := manager.RequireAppRole(viewerContext, app.ID, RoleViewer); err != nil {
+		t.Fatalf("viewer should read application: %v", err)
+	}
+	if err := manager.RequireAppRole(viewerContext, app.ID, RoleAppOwner); !errors.Is(err, ErrForbidden) {
+		t.Fatalf("viewer must not edit application: %v", err)
+	}
+
+	clock = clock.Add(2 * time.Hour)
+	if _, err := manager.AuthenticateRequest(request); !errors.Is(err, ErrUnauthorized) {
+		t.Fatalf("expired token must be rejected: %v", err)
+	}
+	tampered := httptest.NewRequest("GET", "/", nil)
+	tampered.Header.Set("Authorization", "Bearer "+token+"x")
+	if _, err := manager.AuthenticateRequest(tampered); !errors.Is(err, ErrUnauthorized) {
+		t.Fatalf("tampered token must be rejected: %v", err)
+	}
+}
diff --git a/internal/config/config.go b/internal/config/config.go
new file mode 100644
index 0000000..46c7f07
--- /dev/null
+++ b/internal/config/config.go
@@ -0,0 +1,103 @@
+package config
+
+import (
+	"os"
+	"strconv"
+	"strings"
+	"time"
+)
+
+type Config struct {
+	HTTPAddr                  string
+	DatabaseURL               string
+	EtcdEndpoints             []string
+	EtcdDialTimeout           time.Duration
+	OutboxInterval            time.Duration
+	OutboxBatchSize           int
+	OutboxMaxRetry            int
+	ShutdownTimeout           time.Duration
+	AllowedOrigins            []string
+	AuthEnabled               bool
+	JWTSecret                 string
+	JWTTTL                    time.Duration
+	BootstrapAdminUsername    string
+	BootstrapAdminPassword    string
+	BootstrapAdminDisplayName string
+}
+
+func Load() Config {
+	return Config{
+		HTTPAddr:                  env("HTTP_ADDR", ":8080"),
+		DatabaseURL:               strings.TrimSpace(os.Getenv("DATABASE_URL")),
+		EtcdEndpoints:             csv(os.Getenv("ETCD_ENDPOINTS")),
+		EtcdDialTimeout:           duration("ETCD_DIAL_TIMEOUT", 5*time.Second),
+		OutboxInterval:            duration("OUTBOX_INTERVAL", 500*time.Millisecond),
+		OutboxBatchSize:           integer("OUTBOX_BATCH_SIZE", 50),
+		OutboxMaxRetry:            integer("OUTBOX_MAX_RETRY", 12),
+		ShutdownTimeout:           duration("SHUTDOWN_TIMEOUT", 10*time.Second),
+		AllowedOrigins:            csvDefault(os.Getenv("CORS_ALLOWED_ORIGINS"), []string{"http://localhost:5173"}),
+		AuthEnabled:               boolean("AUTH_ENABLED", false),
+		JWTSecret:                 strings.TrimSpace(os.Getenv("JWT_SECRET")),
+		JWTTTL:                    duration("JWT_TTL", 8*time.Hour),
+		BootstrapAdminUsername:    env("BOOTSTRAP_ADMIN_USERNAME", "admin"),
+		BootstrapAdminPassword:    os.Getenv("BOOTSTRAP_ADMIN_PASSWORD"),
+		BootstrapAdminDisplayName: env("BOOTSTRAP_ADMIN_DISPLAY_NAME", "Administrator"),
+	}
+}
+
+func env(key, fallback string) string {
+	if value := strings.TrimSpace(os.Getenv(key)); value != "" {
+		return value
+	}
+	return fallback
+}
+
+func duration(key string, fallback time.Duration) time.Duration {
+	value := strings.TrimSpace(os.Getenv(key))
+	if value == "" {
+		return fallback
+	}
+	parsed, err := time.ParseDuration(value)
+	if err != nil {
+		return fallback
+	}
+	return parsed
+}
+
+func integer(key string, fallback int) int {
+	parsed, err := strconv.Atoi(strings.TrimSpace(os.Getenv(key)))
+	if err != nil || parsed <= 0 {
+		return fallback
+	}
+	return parsed
+}
+
+func boolean(key string, fallback bool) bool {
+	value := strings.TrimSpace(os.Getenv(key))
+	if value == "" {
+		return fallback
+	}
+	parsed, err := strconv.ParseBool(value)
+	if err != nil {
+		return fallback
+	}
+	return parsed
+}
+
+func csv(value string) []string {
+	parts := strings.Split(value, ",")
+	result := make([]string, 0, len(parts))
+	for _, part := range parts {
+		if trimmed := strings.TrimSpace(part); trimmed != "" {
+			result = append(result, trimmed)
+		}
+	}
+	return result
+}
+
+func csvDefault(value string, fallback []string) []string {
+	if result := csv(value); len(result) > 0 {
+		return result
+	}
+	return fallback
+}
diff --git a/internal/domain/models.go b/internal/domain/models.go
new file mode 100644
index 0000000..025f0ab
--- /dev/null
+++ b/internal/domain/models.go
@@ -0,0 +1,168 @@
+package domain
+
+import (
+	"encoding/json"
+	"time"
+)
+
+type Application struct {
+	ID         int64     `json:"id"`
+	Code       string    `json:"code"`
+	Name       string    `json:"name"`
+	Department string    `json:"department"`
+	Owner      string    `json:"owner"`
+	Desc       string    `json:"desc"`
+	CreatedAt  time.Time `json:"createdAt"`
+	UpdatedAt  time.Time `json:"updatedAt"`
+	UpdatedBy  string    `json:"-"`
+}
+
+type Environment struct {
+	ID        int64  `json:"id"`
+	Code      string `json:"code"`
+	Name      string `json:"name"`
+	Order     int    `json:"order"`
+	Desc      string `json:"desc"`
+	UpdatedBy string `json:"-"`
+}
+
+type Namespace struct {
+	ID        int64  `json:"id"`
+	AppID     int64  `json:"appId"`
+	Name      string `json:"name"`
+	Type      string `json:"type"`
+	Desc      string `json:"desc"`
+	UpdatedBy string `json:"-"`
+}
+
+type ConfigItem struct {
+	ID            int64     `json:"id"`
+	AppID         int64     `json:"appId"`
+	NamespaceID   int64     `json:"nsId"`
+	EnvironmentID int64     `json:"envId"`
+	Key           string    `json:"key"`
+	Value         string    `json:"value"`
+	ReleasedValue *string   `json:"releasedValue"`
+	PendingDelete bool      `json:"pendingDelete"`
+	Comment       string    `json:"comment"`
+	UpdatedBy     string    `json:"updatedBy"`
+	UpdatedAt     time.Time `json:"updatedAt"`
+}
+
+func (item ConfigItem) Pending() bool {
+	return item.PendingDelete || item.ReleasedValue == nil || *item.ReleasedValue != item.Value
+}
+
+type Release struct {
+	ID            int64             `json:"id"`
+	AppID         int64             `json:"appId"`
+	NamespaceID   int64             `json:"nsId"`
+	EnvironmentID int64             `json:"envId"`
+	Version       int               `json:"version"`
+	Snapshot      map[string]string `json:"snapshot"`
+	Added         int               `json:"added"`
+	Modified      int               `json:"modified"`
+	Removed       int               `json:"removed"`
+	Comment       string            `json:"comment"`
+	Operator      string            `json:"operator"`
+	EtcdRevision  *int64            `json:"etcdRevision"`
+	Status        string            `json:"status"`
+	Time          time.Time         `json:"time"`
+}
+
+type PublishRequest struct {
+	EnvironmentID int64  `json:"envId"`
+	AppID         int64  `json:"appId"`
+	NamespaceID   int64  `json:"nsId"`
+	Comment       string `json:"comment"`
+	Operator      string `json:"operator"`
+}
+
+type RollbackRequest struct {
+	EnvironmentID int64  `json:"envId"`
+	AppID         int64  `json:"appId"`
+	NamespaceID   int64  `json:"nsId"`
+	TargetVersion int    `json:"targetVersion"`
+	Operator      string `json:"operator"`
+}
+
+type RuntimeConfig struct {
+	Items          map[string]string `json:"items"`
+	Revision       int64             `json:"revision"`
+	ReleaseVersion int               `json:"releaseVersion"`
+	GrayRuleIDs    []int64           `json:"grayRuleIds,omitempty"`
+}
+
+type OutboxEntry struct {
+	ID         int64
+	ReleaseID  int64
+	EtcdKey    string
+	Payload    json.RawMessage
+	RetryCount int
+}
+
+type AuditLog struct {
+	ID         int64           `json:"id"`
+	Actor      string          `json:"actor"`
+	Action     string          `json:"action"`
+	TargetType string          `json:"targetType"`
+	TargetID   *int64          `json:"targetId"`
+	Detail     json.RawMessage `json:"detail"`
+	CreatedAt  time.Time       `json:"createdAt"`
+}
+
+type ConfigEvent struct {
+	Type        string            `json:"type"`
+	Items       map[string]string `json:"items"`
+	Revision    int64             `json:"revision"`
+	GrayRuleIDs []int64           `json:"grayRuleIds,omitempty"`
+}
+
+type User struct {
+	ID          int64     `json:"id"`
+	Username    string    `json:"username"`
+	DisplayName string    `json:"displayName"`
+	IsAdmin     bool      `json:"isAdmin"`
+	Disabled    bool      `json:"disabled"`
+	CreatedAt   time.Time `json:"createdAt"`
+	UpdatedBy   string    `json:"-"`
+}
+
+type UserCredential struct {
+	User
+	PasswordHash string `json:"-"`
+}
+
+type UserAppRole struct {
+	UserID    int64  `json:"userId"`
+	AppID     int64  `json:"appId"`
+	Role      string `json:"role"`
+	UpdatedBy string `json:"-"`
+}
+
+type Principal struct {
+	UserID      int64  `json:"userId"`
+	Username    string `json:"username"`
+	DisplayName string `json:"displayName"`
+	IsAdmin     bool   `json:"isAdmin"`
+}
+
+type GrayRule struct {
+	ID            int64             `json:"id"`
+	AppID         int64             `json:"appId"`
+	NamespaceID   int64             `json:"nsId"`
+	EnvironmentID int64             `json:"envId"`
+	RuleType      string            `json:"ruleType"`
+	RuleValue     json.RawMessage   `json:"ruleValue"`
+	Overrides     map[string]string `json:"overrides"`
+	Enabled       bool              `json:"enabled"`
+	Priority      int               `json:"priority"`
+	Desc          string            `json:"desc"`
+	CreatedAt     time.Time         `json:"createdAt"`
+}
+
+type OutboxStats struct {
+	Pending    int64 `json:"pending"`
+	Processing int64 `json:"processing"`
+	Failed     int64 `json:"failed"`
+}
diff --git a/internal/gray/matcher.go b/internal/gray/matcher.go
new file mode 100644
index 0000000..5ef1af8
--- /dev/null
+++ b/internal/gray/matcher.go
@@ -0,0 +1,159 @@
+package gray
+
+import (
+	"crypto/sha256"
+	"encoding/binary"
+	"encoding/json"
+	"fmt"
+	"net"
+	"sort"
+	"strings"
+
+	"github.com/longpeng/configcenter/internal/domain"
+)
+
+const (
+	RuleIP         = "ip"
+	RuleInstance   = "instance"
+	RulePercentage = "percentage"
+)
+
+type Target struct {
+	IP       string
+	Instance string
+}
+
+type ipRule struct {
+	IPs []string `json:"ips"`
+}
+
+type instanceRule struct {
+	Instances []string `json:"instances"`
+}
+
+type percentageRule struct {
+	Percentage int    `json:"percentage"`
+	Salt       string `json:"salt"`
+}
+
+func Validate(rule domain.GrayRule) error {
+	if rule.NamespaceID <= 0 || rule.EnvironmentID <= 0 || len(rule.Overrides) == 0 {
+		return fmt.Errorf("scope and overrides are required")
+	}
+	for key := range rule.Overrides {
+		if strings.TrimSpace(key) == "" {
+			return fmt.Errorf("override key must not be empty")
+		}
+	}
+	switch rule.RuleType {
+	case RuleIP:
+		var value ipRule
+		if err := strictUnmarshal(rule.RuleValue, &value); err != nil || len(value.IPs) == 0 {
+			return fmt.Errorf("ip rule requires a non-empty ips array")
+		}
+		for _, item := range value.IPs {
+			if net.ParseIP(item) == nil {
+				if _, _, err := net.ParseCIDR(item); err != nil {
+					return fmt.Errorf("invalid IP or CIDR %q", item)
+				}
+			}
+		}
+	case RuleInstance:
+		var value instanceRule
+		if err := strictUnmarshal(rule.RuleValue, &value); err != nil || len(value.Instances) == 0 {
+			return fmt.Errorf("instance rule requires a non-empty instances array")
+		}
+	case RulePercentage:
+		var value percentageRule
+		if err := strictUnmarshal(rule.RuleValue, &value); err != nil || value.Percentage < 0 || value.Percentage > 100 {
+			return fmt.Errorf("percentage rule requires percentage between 0 and 100")
+		}
+	default:
+		return fmt.Errorf("unsupported gray rule type %q", rule.RuleType)
+	}
+	return nil
+}
+
+func Apply(base map[string]string, rules []domain.GrayRule, target Target) (map[string]string, []int64) {
+	result := clone(base)
+	sorted := append([]domain.GrayRule(nil), rules...)
+	sort.SliceStable(sorted, func(i, j int) bool {
+		if sorted[i].Priority == sorted[j].Priority {
+			return sorted[i].ID < sorted[j].ID
+		}
+		return sorted[i].Priority < sorted[j].Priority
+	})
+	matched := make([]int64, 0)
+	for _, rule := range sorted {
+		if !rule.Enabled || !matches(rule, target) {
+			continue
+		}
+		for key, value := range rule.Overrides {
+			result[key] = value
+		}
+		matched = append(matched, rule.ID)
+	}
+	return result, matched
+}
+
+func matches(rule domain.GrayRule, target Target) bool {
+	switch rule.RuleType {
+	case RuleIP:
+		parsed := net.ParseIP(target.IP)
+		if parsed == nil {
+			return false
+		}
+		var value ipRule
+		if json.Unmarshal(rule.RuleValue, &value) != nil {
+			return false
+		}
+		for _, item := range value.IPs {
+			if ip := net.ParseIP(item); ip != nil && ip.Equal(parsed) {
+				return true
+			}
+			if _, network, err := net.ParseCIDR(item); err == nil && network.Contains(parsed) {
+				return true
+			}
+		}
+	case RuleInstance:
+		var value instanceRule
+		if target.Instance == "" || json.Unmarshal(rule.RuleValue, &value) != nil {
+			return false
+		}
+		for _, instance := range value.Instances {
+			if instance == target.Instance {
+				return true
+			}
+		}
+	case RulePercentage:
+		identity := target.Instance
+		if identity == "" {
+			identity = target.IP
+		}
+		if identity == "" {
+			return false
+		}
+		var value percentageRule
+		if json.Unmarshal(rule.RuleValue, &value) != nil {
+			return false
+		}
+		digest := sha256.Sum256([]byte(value.Salt + "\x00" + identity))
+		bucket := binary.BigEndian.Uint64(digest[:8]) % 100
+		return int(bucket) < value.Percentage
+	}
+	return false
+}
+
+func strictUnmarshal(payload []byte, target any) error {
+	decoder := json.NewDecoder(strings.NewReader(string(payload)))
+	decoder.DisallowUnknownFields()
+	return decoder.Decode(target)
+}
+
+func clone(input map[string]string) map[string]string {
+	result := make(map[string]string, len(input))
+	for key, value := range input {
+		result[key] = value
+	}
+	return result
+}
diff --git a/internal/gray/matcher_test.go b/internal/gray/matcher_test.go
new file mode 100644
index 0000000..2dfc8ba
--- /dev/null
+++ b/internal/gray/matcher_test.go
@@ -0,0 +1,53 @@
+package gray
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/longpeng/configcenter/internal/domain"
+)
+
+func TestApplyMatchesIPInstanceAndPriority(t *testing.T) {
+	rules := []domain.GrayRule{
+		{ID: 1, NamespaceID: 1, EnvironmentID: 1, RuleType: RuleIP, RuleValue: json.RawMessage(`{"ips":["10.0.0.0/24"]}`), Overrides: map[string]string{"color": "blue", "ip-only": "yes"}, Enabled: true, Priority: 10},
+		{ID: 2, NamespaceID: 1, EnvironmentID: 1, RuleType: RuleInstance, RuleValue: json.RawMessage(`{"instances":["orders-7"]}`), Overrides: map[string]string{"color": "green"}, Enabled: true, Priority: 20},
+	}
+	for _, rule := range rules {
+		if err := Validate(rule); err != nil {
+			t.Fatalf("valid rule rejected: %v", err)
+		}
+	}
+	items, matched := Apply(map[string]string{"color": "red", "stable": "value"}, rules, Target{IP: "10.0.0.42", Instance: "orders-7"})
+	if items["color"] != "green" || items["ip-only"] != "yes" || items["stable"] != "value" {
+		t.Fatalf("unexpected overrides: %#v", items)
+	}
+	if len(matched) != 2 || matched[0] != 1 || matched[1] != 2 {
+		t.Fatalf("unexpected matched rules: %#v", matched)
+	}
+}
+
+func TestPercentageRuleIsDeterministic(t *testing.T) {
+	rule := domain.GrayRule{ID: 3, NamespaceID: 1, EnvironmentID: 1, RuleType: RulePercentage, RuleValue: json.RawMessage(`{"percentage":50,"salt":"release-a"}`), Overrides: map[string]string{"feature": "on"}, Enabled: true}
+	if err := Validate(rule); err != nil {
+		t.Fatal(err)
+	}
+	firstItems, firstMatched := Apply(map[string]string{"feature": "off"}, []domain.GrayRule{rule}, Target{Instance: "orders-42"})
+	for i := 0; i < 20; i++ {
+		items, matched := Apply(map[string]string{"feature": "off"}, []domain.GrayRule{rule}, Target{Instance: "orders-42"})
+		if items["feature"] != firstItems["feature"] || len(matched) != len(firstMatched) {
+			t.Fatalf("percentage assignment changed between calls: first=%#v/%#v current=%#v/%#v", firstItems, firstMatched, items, matched)
+		}
+	}
+}
+
+func TestValidateRejectsInvalidCIDRAndPercentage(t *testing.T) {
+	cases := []domain.GrayRule{
+		{NamespaceID: 1, EnvironmentID: 1, RuleType: RuleIP, RuleValue: json.RawMessage(`{"ips":["not-an-ip"]}`), Overrides: map[string]string{"x": "y"}},
+		{NamespaceID: 1, EnvironmentID: 1, RuleType: RulePercentage, RuleValue: json.RawMessage(`{"percentage":101}`), Overrides: map[string]string{"x": "y"}},
+	}
+	for _, rule := range cases {
+		if err := Validate(rule); err == nil {
+			t.Fatalf("invalid rule accepted: %#v", rule)
+		}
+	}
+}
diff --git a/internal/metrics/metrics.go b/internal/metrics/metrics.go
new file mode 100644
index 0000000..7629321
--- /dev/null
+++ b/internal/metrics/metrics.go
@@ -0,0 +1,130 @@
+package metrics
+
+import (
+	"fmt"
+	"net/http"
+	"sort"
+	"strconv"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/longpeng/configcenter/internal/store"
+)
+
+type Collector struct {
+	mu   sync.Mutex
+	http map[httpKey]httpValue
+
+	publishAccepted atomic.Uint64
+	outboxApplied   atomic.Uint64
+	outboxFailed    atomic.Uint64
+	runtimeReads    atomic.Uint64
+	grayMatches     atomic.Uint64
+	watchers        atomic.Int64
+}
+
+type httpKey struct {
+	method string
+	route  string
+	status int
+}
+
+type httpValue struct {
+	count       uint64
+	durationSum float64
+}
+
+func New() *Collector { return &Collector{http: make(map[httpKey]httpValue)} }
+
+func (c *Collector) ObserveHTTP(method, route string, status int, duration time.Duration) {
+	if route == "" {
+		route = "unmatched"
+	}
+	key := httpKey{method: method, route: route, status: status}
+	c.mu.Lock()
+	value := c.http[key]
+	value.count++
+	value.durationSum += duration.Seconds()
+	c.http[key] = value
+	c.mu.Unlock()
+}
+
+func (c *Collector) PublishAccepted() { c.publishAccepted.Add(1) }
+func (c *Collector) OutboxApplied()   { c.outboxApplied.Add(1) }
+func (c *Collector) OutboxFailed()    { c.outboxFailed.Add(1) }
+func (c *Collector) RuntimeRead()     { c.runtimeReads.Add(1) }
+func (c *Collector) GrayMatched(count int) {
+	if count > 0 {
+		c.grayMatches.Add(uint64(count))
+	}
+}
+func (c *Collector) WatcherAdded()   { c.watchers.Add(1) }
+func (c *Collector) WatcherRemoved() { c.watchers.Add(-1) }
+
+func (c *Collector) Handler(repository store.Store) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "text/plain; version=0.0.4; charset=utf-8")
+		stats, err := repository.OutboxStats(r.Context())
+		if err != nil {
+			http.Error(w, "collect outbox metrics", http.StatusServiceUnavailable)
+			return
+		}
+		var output strings.Builder
+		writeHelp(&output, "configcenter_http_requests_total", "HTTP requests by method, route and status", "counter")
+		writeHelp(&output, "configcenter_http_request_duration_seconds_sum", "Cumulative HTTP request duration", "counter")
+		c.mu.Lock()
+		keys := make([]httpKey, 0, len(c.http))
+		for key := range c.http {
+			keys = append(keys, key)
+		}
+		sort.Slice(keys, func(i, j int) bool {
+			if keys[i].route != keys[j].route {
+				return keys[i].route < keys[j].route
+			}
+			if keys[i].method != keys[j].method {
+				return keys[i].method < keys[j].method
+			}
+			return keys[i].status < keys[j].status
+		})
+		for _, key := range keys {
+			value := c.http[key]
+			labels := fmt.Sprintf(`method="%s",route="%s",status="%d"`, escape(key.method), escape(key.route), key.status)
+			fmt.Fprintf(&output, "configcenter_http_requests_total{%s} %d\n", labels, value.count)
+			fmt.Fprintf(&output, "configcenter_http_request_duration_seconds_sum{%s} %s\n", labels, strconv.FormatFloat(value.durationSum, 'f', 6, 64))
+		}
+		c.mu.Unlock()
+
+		writeCounter(&output, "configcenter_publish_accepted_total", "Accepted configuration releases", c.publishAccepted.Load())
+		writeCounter(&output, "configcenter_outbox_applied_total", "Successfully applied outbox entries", c.outboxApplied.Load())
+		writeCounter(&output, "configcenter_outbox_failed_attempts_total", "Failed outbox apply attempts", c.outboxFailed.Load())
+		writeCounter(&output, "configcenter_runtime_reads_total", "Runtime configuration reads", c.runtimeReads.Load())
+		writeCounter(&output, "configcenter_gray_rule_matches_total", "Gray rules matched during runtime reads and watches", c.grayMatches.Load())
+		writeGauge(&output, "configcenter_watch_subscribers", "Current SSE watch subscribers", c.watchers.Load())
+		writeGauge(&output, "configcenter_outbox_pending", "Pending outbox entries", stats.Pending)
+		writeGauge(&output, "configcenter_outbox_processing", "Processing outbox entries", stats.Processing)
+		writeGauge(&output, "configcenter_outbox_failed", "Terminally failed outbox entries", stats.Failed)
+		_, _ = w.Write([]byte(output.String()))
+	}
+}
+
+func writeHelp(output *strings.Builder, name, help, metricType string) {
+	fmt.Fprintf(output, "# HELP %s %s\n# TYPE %s %s\n", name, help, name, metricType)
+}
+
+func writeCounter(output *strings.Builder, name, help string, value uint64) {
+	writeHelp(output, name, help, "counter")
+	fmt.Fprintf(output, "%s %d\n", name, value)
+}
+
+func writeGauge(output *strings.Builder, name, help string, value int64) {
+	writeHelp(output, name, help, "gauge")
+	fmt.Fprintf(output, "%s %d\n", name, value)
+}
+
+func escape(value string) string {
+	value = strings.ReplaceAll(value, `\`, `\\`)
+	value = strings.ReplaceAll(value, `"`, `\"`)
+	return strings.ReplaceAll(value, "\n", `\n`)
+}
diff --git a/internal/outbox/worker.go b/internal/outbox/worker.go
new file mode 100644
index 0000000..91588b0
--- /dev/null
+++ b/internal/outbox/worker.go
@@ -0,0 +1,67 @@
+package outbox
+
+import (
+	"context"
+	"log/slog"
+	"time"
+
+	metricspkg "github.com/longpeng/configcenter/internal/metrics"
+	runtimepkg "github.com/longpeng/configcenter/internal/runtime"
+	"github.com/longpeng/configcenter/internal/store"
+)
+
+type Worker struct {
+	store    store.Store
+	runtime  runtimepkg.Store
+	interval time.Duration
+	batch    int
+	maxRetry int
+	logger   *slog.Logger
+	metrics  *metricspkg.Collector
+}
+
+func New(repository store.Store, runtimeStore runtimepkg.Store, interval time.Duration, batch, maxRetry int, metrics *metricspkg.Collector, logger *slog.Logger) *Worker {
+	return &Worker{store: repository, runtime: runtimeStore, interval: interval, batch: batch, maxRetry: maxRetry, metrics: metrics, logger: logger}
+}
+
+func (w *Worker) Run(ctx context.Context) {
+	ticker := time.NewTicker(w.interval)
+	defer ticker.Stop()
+	w.process(ctx)
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-ticker.C:
+			w.process(ctx)
+		}
+	}
+}
+
+func (w *Worker) process(ctx context.Context) {
+	entries, err := w.store.ClaimOutbox(ctx, w.batch)
+	if err != nil {
+		w.logger.Error("claim outbox", "error", err)
+		return
+	}
+	for _, entry := range entries {
+		release, err := w.store.GetRelease(ctx, entry.ReleaseID)
+		if err == nil {
+			var revision int64
+			revision, err = w.runtime.Put(ctx, entry.EtcdKey, entry.Payload, release)
+			if err == nil {
+				err = w.store.MarkOutboxDone(ctx, entry.ID, entry.ReleaseID, revision)
+				if err == nil {
+					w.metrics.OutboxApplied()
+				}
+			}
+		}
+		if err != nil {
+			w.metrics.OutboxFailed()
+			w.logger.Warn("apply release outbox", "outbox_id", entry.ID, "release_id", entry.ReleaseID, "retry", entry.RetryCount, "error", err)
+			if markErr := w.store.MarkOutboxFailed(ctx, entry.ID, entry.ReleaseID, err.Error(), w.maxRetry); markErr != nil {
+				w.logger.Error("mark outbox failed", "outbox_id", entry.ID, "error", markErr)
+			}
+		}
+	}
+}
diff --git a/internal/runtime/etcd/etcd.go b/internal/runtime/etcd/etcd.go
new file mode 100644
index 0000000..5889c5a
--- /dev/null
+++ b/internal/runtime/etcd/etcd.go
@@ -0,0 +1,122 @@
+package etcd
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"time"
+
+	clientv3 "go.etcd.io/etcd/client/v3"
+
+	"github.com/longpeng/configcenter/internal/domain"
+	runtimepkg "github.com/longpeng/configcenter/internal/runtime"
+)
+
+type Store struct {
+	client *clientv3.Client
+}
+
+type metadata struct {
+	Version     int       `json:"version"`
+	ReleaseID   int64     `json:"releaseId"`
+	PublishedAt time.Time `json:"publishedAt"`
+	PublishedBy string    `json:"publishedBy"`
+}
+
+func Open(endpoints []string, dialTimeout time.Duration) (*Store, error) {
+	client, err := clientv3.New(clientv3.Config{Endpoints: endpoints, DialTimeout: dialTimeout})
+	if err != nil {
+		return nil, fmt.Errorf("create etcd client: %w", err)
+	}
+	return &Store{client: client}, nil
+}
+
+func (s *Store) Close() error { return s.client.Close() }
+
+func (s *Store) Ping(ctx context.Context) error {
+	_, err := s.client.Get(ctx, "/configcenter/health", clientv3.WithLimit(1))
+	return err
+}
+
+func (s *Store) Put(ctx context.Context, key string, payload []byte, release domain.Release) (int64, error) {
+	meta, err := json.Marshal(metadata{Version: release.Version, ReleaseID: release.ID, PublishedAt: release.Time, PublishedBy: release.Operator})
+	if err != nil {
+		return 0, err
+	}
+	response, err := s.client.Txn(ctx).Then(
+		clientv3.OpPut(key, string(payload)),
+		clientv3.OpPut(key+"/__meta", string(meta)),
+	).Commit()
+	if err != nil {
+		return 0, err
+	}
+	return response.Header.Revision, nil
+}
+
+func (s *Store) Get(ctx context.Context, key string) (domain.RuntimeConfig, error) {
+	response, err := s.client.Txn(ctx).Then(
+		clientv3.OpGet(key),
+		clientv3.OpGet(key+"/__meta"),
+	).Commit()
+	if err != nil {
+		return domain.RuntimeConfig{}, err
+	}
+	result := domain.RuntimeConfig{Items: map[string]string{}, Revision: response.Header.Revision}
+	if len(response.Responses) > 0 {
+		values := response.Responses[0].GetResponseRange().Kvs
+		if len(values) > 0 {
+			if err := json.Unmarshal(values[0].Value, &result.Items); err != nil {
+				return domain.RuntimeConfig{}, fmt.Errorf("decode runtime config: %w", err)
+			}
+			result.Revision = values[0].ModRevision
+		}
+	}
+	if len(response.Responses) > 1 {
+		values := response.Responses[1].GetResponseRange().Kvs
+		if len(values) > 0 {
+			var meta metadata
+			if err := json.Unmarshal(values[0].Value, &meta); err != nil {
+				return domain.RuntimeConfig{}, fmt.Errorf("decode runtime metadata: %w", err)
+			}
+			result.ReleaseVersion = meta.Version
+		}
+	}
+	return result, nil
+}
+
+func (s *Store) Watch(ctx context.Context, key string, startRevision int64) <-chan runtimepkg.WatchResult {
+	result := make(chan runtimepkg.WatchResult, 16)
+	options := []clientv3.OpOption{}
+	if startRevision > 0 {
+		options = append(options, clientv3.WithRev(startRevision))
+	}
+	watch := s.client.Watch(ctx, key, options...)
+	go func() {
+		defer close(result)
+		for response := range watch {
+			if err := response.Err(); err != nil {
+				select {
+				case result <- runtimepkg.WatchResult{Err: err}:
+				case <-ctx.Done():
+				}
+				return
+			}
+			for _, event := range response.Events {
+				items := make(map[string]string)
+				if err := json.Unmarshal(event.Kv.Value, &items); err != nil {
+					select {
+					case result <- runtimepkg.WatchResult{Err: err}:
+					case <-ctx.Done():
+					}
+					continue
+				}
+				select {
+				case result <- runtimepkg.WatchResult{Event: domain.ConfigEvent{Type: "UPDATED", Items: items, Revision: event.Kv.ModRevision}}:
+				case <-ctx.Done():
+					return
+				}
+			}
+		}
+	}()
+	return result
+}
diff --git a/internal/runtime/memory/memory.go b/internal/runtime/memory/memory.go
new file mode 100644
index 0000000..c8ccb02
--- /dev/null
+++ b/internal/runtime/memory/memory.go
@@ -0,0 +1,120 @@
+package memory
+
+import (
+	"context"
+	"encoding/json"
+	"sync"
+
+	"github.com/longpeng/configcenter/internal/domain"
+	runtimepkg "github.com/longpeng/configcenter/internal/runtime"
+)
+
+type value struct {
+	items    map[string]string
+	revision int64
+	version  int
+}
+
+type historyEvent struct {
+	key   string
+	event domain.ConfigEvent
+}
+
+type subscriber struct {
+	key string
+	ch  chan runtimepkg.WatchResult
+}
+
+type Store struct {
+	mu          sync.RWMutex
+	revision    int64
+	values      map[string]value
+	subscribers map[int64]subscriber
+	nextSubID   int64
+	history     []historyEvent
+}
+
+func New() *Store {
+	return &Store{values: make(map[string]value), subscribers: make(map[int64]subscriber)}
+}
+
+func (s *Store) Close() error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	for id, sub := range s.subscribers {
+		close(sub.ch)
+		delete(s.subscribers, id)
+	}
+	return nil
+}
+
+func (s *Store) Ping(context.Context) error { return nil }
+
+func (s *Store) Put(_ context.Context, key string, payload []byte, release domain.Release) (int64, error) {
+	items := make(map[string]string)
+	if err := json.Unmarshal(payload, &items); err != nil {
+		return 0, err
+	}
+	s.mu.Lock()
+	s.revision++
+	revision := s.revision
+	s.values[key] = value{items: clone(items), revision: revision, version: release.Version}
+	event := domain.ConfigEvent{Type: "UPDATED", Items: clone(items), Revision: revision}
+	s.history = append(s.history, historyEvent{key: key, event: event})
+	if len(s.history) > 256 {
+		s.history = append([]historyEvent(nil), s.history[len(s.history)-256:]...)
+	}
+	for _, sub := range s.subscribers {
+		if sub.key != key {
+			continue
+		}
+		select {
+		case sub.ch <- runtimepkg.WatchResult{Event: event}:
+		default:
+		}
+	}
+	s.mu.Unlock()
+	return revision, nil
+}
+
+func (s *Store) Get(_ context.Context, key string) (domain.RuntimeConfig, error) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	current, ok := s.values[key]
+	if !ok {
+		return domain.RuntimeConfig{Items: map[string]string{}, Revision: s.revision}, nil
+	}
+	return domain.RuntimeConfig{Items: clone(current.items), Revision: current.revision, ReleaseVersion: current.version}, nil
+}
+
+func (s *Store) Watch(ctx context.Context, key string, startRevision int64) <-chan runtimepkg.WatchResult {
+	ch := make(chan runtimepkg.WatchResult, 16)
+	s.mu.Lock()
+	s.nextSubID++
+	id := s.nextSubID
+	s.subscribers[id] = subscriber{key: key, ch: ch}
+	for _, historical := range s.history {
+		if historical.key == key && historical.event.Revision >= startRevision && startRevision > 0 {
+			ch <- runtimepkg.WatchResult{Event: historical.event}
+		}
+	}
+	s.mu.Unlock()
+	go func() {
+		<-ctx.Done()
+		s.mu.Lock()
+		if _, ok := s.subscribers[id]; ok {
+			delete(s.subscribers, id)
+			close(ch)
+		}
+		s.mu.Unlock()
+	}()
+	return ch
+}
+
+func clone(input map[string]string) map[string]string {
+	result := make(map[string]string, len(input))
+	for key, item := range input {
+		result[key] = item
+	}
+	return result
+}
diff --git a/internal/runtime/runtime.go b/internal/runtime/runtime.go
new file mode 100644
index 0000000..1865f7a
--- /dev/null
+++ b/internal/runtime/runtime.go
@@ -0,0 +1,20 @@
+package runtime
+
+import (
+	"context"
+
+	"github.com/longpeng/configcenter/internal/domain"
+)
+
+type WatchResult struct {
+	Event domain.ConfigEvent
+	Err   error
+}
+
+type Store interface {
+	Close() error
+	Ping(context.Context) error
+	Put(context.Context, string, []byte, domain.Release) (int64, error)
+	Get(context.Context, string) (domain.RuntimeConfig, error)
+	Watch(context.Context, string, int64) <-chan WatchResult
+}
diff --git a/internal/store/memory/memory.go b/internal/store/memory/memory.go
new file mode 100644
index 0000000..4926f7b
--- /dev/null
+++ b/internal/store/memory/memory.go
@@ -0,0 +1,884 @@
+package memory
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"sort"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/longpeng/configcenter/internal/domain"
+	storepkg "github.com/longpeng/configcenter/internal/store"
+)
+
+type Store struct {
+	mu           sync.RWMutex
+	nextID       int64
+	applications map[int64]domain.Application
+	environments map[int64]domain.Environment
+	namespaces   map[int64]domain.Namespace
+	configs      map[int64]domain.ConfigItem
+	releases     map[int64]domain.Release
+	outbox       map[int64]outboxRecord
+	audits       []domain.AuditLog
+	users        map[int64]domain.UserCredential
+	userRoles    map[[2]int64]string
+	grayRules    map[int64]domain.GrayRule
+}
+
+type outboxRecord struct {
+	domain.OutboxEntry
+	Status      string
+	NextAttempt time.Time
+}
+
+func New(withSeed bool) *Store {
+	s := &Store{
+		nextID:       100,
+		applications: make(map[int64]domain.Application),
+		environments: make(map[int64]domain.Environment),
+		namespaces:   make(map[int64]domain.Namespace),
+		configs:      make(map[int64]domain.ConfigItem),
+		releases:     make(map[int64]domain.Release),
+		outbox:       make(map[int64]outboxRecord),
+		users:        make(map[int64]domain.UserCredential),
+		userRoles:    make(map[[2]int64]string),
+		grayRules:    make(map[int64]domain.GrayRule),
+	}
+	if withSeed {
+		s.seed()
+	}
+	return s
+}
+
+func (s *Store) Close() {}
+
+func (s *Store) Ping(context.Context) error { return nil }
+
+func (s *Store) id() int64 {
+	s.nextID++
+	return s.nextID
+}
+
+func (s *Store) seed() {
+	now := time.Now().UTC()
+	for _, env := range []domain.Environment{
+		{ID: 1, Code: "DEV", Name: "开发环境", Order: 1, Desc: "开发联调使用"},
+		{ID: 2, Code: "TEST", Name: "测试环境", Order: 2, Desc: "QA 测试验证"},
+		{ID: 3, Code: "STAGING", Name: "预发环境", Order: 3, Desc: "上线前灰度验证"},
+		{ID: 4, Code: "PROD", Name: "生产环境", Order: 4, Desc: "线上正式环境"},
+	} {
+		s.environments[env.ID] = env
+	}
+	app := domain.Application{ID: 10, Code: "demo-service", Name: "示例服务", Department: "平台架构部", Owner: "admin", Desc: "开箱即用的演示应用", CreatedAt: now, UpdatedAt: now}
+	ns := domain.Namespace{ID: 20, AppID: app.ID, Name: "application", Type: "properties", Desc: "默认应用配置"}
+	s.applications[app.ID] = app
+	s.namespaces[ns.ID] = ns
+	port := "8080"
+	level := "INFO"
+	s.configs[30] = domain.ConfigItem{ID: 30, AppID: app.ID, NamespaceID: ns.ID, EnvironmentID: 1, Key: "server.port", Value: port, ReleasedValue: &port, Comment: "服务监听端口", UpdatedBy: "system", UpdatedAt: now}
+	s.configs[31] = domain.ConfigItem{ID: 31, AppID: app.ID, NamespaceID: ns.ID, EnvironmentID: 1, Key: "log.level", Value: level, ReleasedValue: &level, Comment: "日志级别", UpdatedBy: "system", UpdatedAt: now}
+	release := domain.Release{ID: 40, AppID: app.ID, NamespaceID: ns.ID, EnvironmentID: 1, Version: 1, Snapshot: map[string]string{"server.port": port, "log.level": level}, Added: 2, Operator: "system", Comment: "初始化示例配置", Status: "pending", Time: now}
+	s.releases[release.ID] = release
+	s.enqueue(release)
+}
+
+func (s *Store) ListApplications(context.Context) ([]domain.Application, error) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	result := make([]domain.Application, 0, len(s.applications))
+	for _, item := range s.applications {
+		result = append(result, item)
+	}
+	sort.Slice(result, func(i, j int) bool { return result[i].Code < result[j].Code })
+	return result, nil
+}
+
+func (s *Store) CreateApplication(_ context.Context, input domain.Application) (domain.Application, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	for _, item := range s.applications {
+		if strings.EqualFold(item.Code, input.Code) {
+			return domain.Application{}, storepkg.ErrConflict
+		}
+	}
+	now := time.Now().UTC()
+	input.ID, input.CreatedAt, input.UpdatedAt = s.id(), now, now
+	s.applications[input.ID] = input
+	s.audit(defaultActor(input.UpdatedBy), "create", "app", input.ID, input)
+	return input, nil
+}
+
+func (s *Store) UpdateApplication(_ context.Context, id int64, input domain.Application) (domain.Application, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	current, ok := s.applications[id]
+	if !ok {
+		return domain.Application{}, storepkg.ErrNotFound
+	}
+	current.Name, current.Department, current.Owner, current.Desc = input.Name, input.Department, input.Owner, input.Desc
+	current.UpdatedAt = time.Now().UTC()
+	s.applications[id] = current
+	s.audit(defaultActor(input.UpdatedBy), "update", "app", id, current)
+	return current, nil
+}
+
+func (s *Store) DeleteApplication(_ context.Context, id int64, actor string) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if _, ok := s.applications[id]; !ok {
+		return storepkg.ErrNotFound
+	}
+	delete(s.applications, id)
+	for nsID, ns := range s.namespaces {
+		if ns.AppID == id {
+			delete(s.namespaces, nsID)
+		}
+	}
+	for configID, item := range s.configs {
+		if item.AppID == id {
+			delete(s.configs, configID)
+		}
+	}
+	for releaseID, item := range s.releases {
+		if item.AppID == id {
+			delete(s.releases, releaseID)
+		}
+	}
+	for ruleID, rule := range s.grayRules {
+		if rule.AppID == id {
+			delete(s.grayRules, ruleID)
+		}
+	}
+	for key := range s.userRoles {
+		if key[1] == id {
+			delete(s.userRoles, key)
+		}
+	}
+	s.audit(defaultActor(actor), "delete", "app", id, nil)
+	return nil
+}
+
+func (s *Store) ListEnvironments(context.Context) ([]domain.Environment, error) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	result := make([]domain.Environment, 0, len(s.environments))
+	for _, item := range s.environments {
+		result = append(result, item)
+	}
+	sort.Slice(result, func(i, j int) bool {
+		if result[i].Order == result[j].Order {
+			return result[i].Code < result[j].Code
+		}
+		return result[i].Order < result[j].Order
+	})
+	return result, nil
+}
+
+func (s *Store) CreateEnvironment(_ context.Context, input domain.Environment) (domain.Environment, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	for _, item := range s.environments {
+		if strings.EqualFold(item.Code, input.Code) {
+			return domain.Environment{}, storepkg.ErrConflict
+		}
+	}
+	input.ID = s.id()
+	input.Code = strings.ToUpper(input.Code)
+	s.environments[input.ID] = input
+	s.audit(defaultActor(input.UpdatedBy), "create", "env", input.ID, input)
+	return input, nil
+}
+
+func (s *Store) UpdateEnvironment(_ context.Context, id int64, input domain.Environment) (domain.Environment, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	current, ok := s.environments[id]
+	if !ok {
+		return domain.Environment{}, storepkg.ErrNotFound
+	}
+	current.Name, current.Order, current.Desc = input.Name, input.Order, input.Desc
+	s.environments[id] = current
+	s.audit(defaultActor(input.UpdatedBy), "update", "env", id, current)
+	return current, nil
+}
+
+func (s *Store) DeleteEnvironment(_ context.Context, id int64, actor string) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if _, ok := s.environments[id]; !ok {
+		return storepkg.ErrNotFound
+	}
+	delete(s.environments, id)
+	for configID, item := range s.configs {
+		if item.EnvironmentID == id {
+			delete(s.configs, configID)
+		}
+	}
+	for releaseID, item := range s.releases {
+		if item.EnvironmentID == id {
+			delete(s.releases, releaseID)
+		}
+	}
+	for ruleID, rule := range s.grayRules {
+		if rule.EnvironmentID == id {
+			delete(s.grayRules, ruleID)
+		}
+	}
+	s.audit(defaultActor(actor), "delete", "env", id, nil)
+	return nil
+}
+
+func (s *Store) ListNamespaces(_ context.Context, appID *int64) ([]domain.Namespace, error) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	result := make([]domain.Namespace, 0)
+	for _, item := range s.namespaces {
+		if appID == nil || item.AppID == *appID {
+			result = append(result, item)
+		}
+	}
+	sort.Slice(result, func(i, j int) bool {
+		if result[i].AppID == result[j].AppID {
+			return result[i].Name < result[j].Name
+		}
+		return result[i].AppID < result[j].AppID
+	})
+	return result, nil
+}
+
+func (s *Store) GetNamespace(_ context.Context, id int64) (domain.Namespace, error) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	item, ok := s.namespaces[id]
+	if !ok {
+		return domain.Namespace{}, storepkg.ErrNotFound
+	}
+	return item, nil
+}
+
+func (s *Store) CreateNamespace(_ context.Context, input domain.Namespace) (domain.Namespace, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if _, ok := s.applications[input.AppID]; !ok {
+		return domain.Namespace{}, storepkg.ErrNotFound
+	}
+	for _, item := range s.namespaces {
+		if item.AppID == input.AppID && strings.EqualFold(item.Name, input.Name) {
+			return domain.Namespace{}, storepkg.ErrConflict
+		}
+	}
+	input.ID = s.id()
+	s.namespaces[input.ID] = input
+	s.audit(defaultActor(input.UpdatedBy), "create", "namespace", input.ID, input)
+	return input, nil
+}
+
+func (s *Store) UpdateNamespace(_ context.Context, id int64, input domain.Namespace) (domain.Namespace, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	current, ok := s.namespaces[id]
+	if !ok {
+		return domain.Namespace{}, storepkg.ErrNotFound
+	}
+	current.Type, current.Desc = input.Type, input.Desc
+	s.namespaces[id] = current
+	s.audit(defaultActor(input.UpdatedBy), "update", "namespace", id, current)
+	return current, nil
+}
+
+func (s *Store) DeleteNamespace(_ context.Context, id int64, actor string) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if _, ok := s.namespaces[id]; !ok {
+		return storepkg.ErrNotFound
+	}
+	delete(s.namespaces, id)
+	for configID, item := range s.configs {
+		if item.NamespaceID == id {
+			delete(s.configs, configID)
+		}
+	}
+	for releaseID, item := range s.releases {
+		if item.NamespaceID == id {
+			delete(s.releases, releaseID)
+		}
+	}
+	for ruleID, rule := range s.grayRules {
+		if rule.NamespaceID == id {
+			delete(s.grayRules, ruleID)
+		}
+	}
+	s.audit(defaultActor(actor), "delete", "namespace", id, nil)
+	return nil
+}
+
+func (s *Store) ListConfigItems(_ context.Context, appID, namespaceID, envID int64) ([]domain.ConfigItem, error) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	result := make([]domain.ConfigItem, 0)
+	for _, item := range s.configs {
+		if item.AppID == appID && item.NamespaceID == namespaceID && item.EnvironmentID == envID {
+			result = append(result, item)
+		}
+	}
+	sort.Slice(result, func(i, j int) bool { return result[i].Key < result[j].Key })
+	return result, nil
+}
+
+func (s *Store) GetConfigItem(_ context.Context, id int64) (domain.ConfigItem, error) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	item, ok := s.configs[id]
+	if !ok {
+		return domain.ConfigItem{}, storepkg.ErrNotFound
+	}
+	return item, nil
+}
+
+func (s *Store) CreateConfigItem(_ context.Context, input domain.ConfigItem) (domain.ConfigItem, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if !s.validScope(input.AppID, input.NamespaceID, input.EnvironmentID) {
+		return domain.ConfigItem{}, storepkg.ErrNotFound
+	}
+	for _, item := range s.configs {
+		if item.NamespaceID == input.NamespaceID && item.EnvironmentID == input.EnvironmentID && item.Key == input.Key {
+			return domain.ConfigItem{}, storepkg.ErrConflict
+		}
+	}
+	input.ID, input.UpdatedAt = s.id(), time.Now().UTC()
+	input.UpdatedBy = defaultActor(input.UpdatedBy)
+	input.ReleasedValue = nil
+	s.configs[input.ID] = input
+	s.audit(input.UpdatedBy, "create", "config", input.ID, input)
+	return input, nil
+}
+
+func (s *Store) UpdateConfigItem(_ context.Context, id int64, input domain.ConfigItem) (domain.ConfigItem, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	current, ok := s.configs[id]
+	if !ok {
+		return domain.ConfigItem{}, storepkg.ErrNotFound
+	}
+	current.Value, current.Comment = input.Value, input.Comment
+	current.UpdatedBy, current.UpdatedAt = defaultActor(input.UpdatedBy), time.Now().UTC()
+	current.PendingDelete = false
+	s.configs[id] = current
+	s.audit(current.UpdatedBy, "update", "config", id, current)
+	return current, nil
+}
+
+func (s *Store) SetConfigItemPendingDelete(_ context.Context, id int64, pending bool, actor string) (domain.ConfigItem, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	current, ok := s.configs[id]
+	if !ok {
+		return domain.ConfigItem{}, storepkg.ErrNotFound
+	}
+	if current.ReleasedValue == nil && pending {
+		delete(s.configs, id)
+		s.audit(defaultActor(actor), "delete", "config", id, map[string]bool{"draftOnly": true})
+		return current, nil
+	}
+	current.PendingDelete, current.UpdatedBy, current.UpdatedAt = pending, defaultActor(actor), time.Now().UTC()
+	s.configs[id] = current
+	s.audit(current.UpdatedBy, "update", "config", id, map[string]bool{"pendingDelete": pending})
+	return current, nil
+}
+
+func (s *Store) Publish(_ context.Context, request domain.PublishRequest) (domain.Release, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if !s.validScope(request.AppID, request.NamespaceID, request.EnvironmentID) {
+		return domain.Release{}, storepkg.ErrNotFound
+	}
+	items := s.scopeItems(request.AppID, request.NamespaceID, request.EnvironmentID)
+	added, modified, removed := 0, 0, 0
+	snapshot := make(map[string]string)
+	for _, item := range items {
+		if item.PendingDelete {
+			removed++
+			continue
+		}
+		snapshot[item.Key] = item.Value
+		if item.ReleasedValue == nil {
+			added++
+		} else if *item.ReleasedValue != item.Value {
+			modified++
+		}
+	}
+	if added+modified+removed == 0 {
+		return domain.Release{}, storepkg.ErrNoPendingChange
+	}
+	release := s.newRelease(request.AppID, request.NamespaceID, request.EnvironmentID, snapshot, added, modified, removed, request.Comment, defaultActor(request.Operator))
+	for id, item := range s.configs {
+		if item.AppID != request.AppID || item.NamespaceID != request.NamespaceID || item.EnvironmentID != request.EnvironmentID {
+			continue
+		}
+		if item.PendingDelete {
+			delete(s.configs, id)
+			continue
+		}
+		value := item.Value
+		item.ReleasedValue, item.PendingDelete = &value, false
+		s.configs[id] = item
+	}
+	s.enqueue(release)
+	s.audit(release.Operator, "publish", "release", release.ID, release)
+	return release, nil
+}
+
+func (s *Store) Rollback(_ context.Context, request domain.RollbackRequest) (domain.Release, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	var target *domain.Release
+	var latest *domain.Release
+	for _, release := range s.releases {
+		if release.AppID != request.AppID || release.NamespaceID != request.NamespaceID || release.EnvironmentID != request.EnvironmentID {
+			continue
+		}
+		copy := release
+		if release.Version == request.TargetVersion {
+			target = &copy
+		}
+		if latest == nil || release.Version > latest.Version {
+			latest = &copy
+		}
+	}
+	if target == nil {
+		return domain.Release{}, storepkg.ErrNotFound
+	}
+	if latest != nil && target.Version == latest.Version {
+		return domain.Release{}, storepkg.ErrInvalidRollback
+	}
+	current := map[string]string{}
+	if latest != nil {
+		current = latest.Snapshot
+	}
+	added, modified, removed := diff(current, target.Snapshot)
+	for id, item := range s.configs {
+		if item.AppID == request.AppID && item.NamespaceID == request.NamespaceID && item.EnvironmentID == request.EnvironmentID {
+			delete(s.configs, id)
+		}
+	}
+	for key, value := range target.Snapshot {
+		copyValue := value
+		item := domain.ConfigItem{ID: s.id(), AppID: request.AppID, NamespaceID: request.NamespaceID, EnvironmentID: request.EnvironmentID, Key: key, Value: value, ReleasedValue: &copyValue, UpdatedBy: defaultActor(request.Operator), UpdatedAt: time.Now().UTC()}
+		s.configs[item.ID] = item
+	}
+	release := s.newRelease(request.AppID, request.NamespaceID, request.EnvironmentID, cloneMap(target.Snapshot), added, modified, removed, fmt.Sprintf("回滚至版本 v%d", target.Version), defaultActor(request.Operator))
+	s.enqueue(release)
+	s.audit(release.Operator, "rollback", "release", release.ID, map[string]any{"targetVersion": target.Version, "newVersion": release.Version})
+	return release, nil
+}
+
+func (s *Store) ListReleases(_ context.Context, appID, namespaceID, envID int64) ([]domain.Release, error) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	result := make([]domain.Release, 0)
+	for _, release := range s.releases {
+		if release.AppID == appID && release.NamespaceID == namespaceID && release.EnvironmentID == envID {
+			release.Snapshot = cloneMap(release.Snapshot)
+			result = append(result, release)
+		}
+	}
+	sort.Slice(result, func(i, j int) bool { return result[i].Version > result[j].Version })
+	return result, nil
+}
+
+func (s *Store) GetRelease(_ context.Context, id int64) (domain.Release, error) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	release, ok := s.releases[id]
+	if !ok {
+		return domain.Release{}, storepkg.ErrNotFound
+	}
+	release.Snapshot = cloneMap(release.Snapshot)
+	return release, nil
+}
+
+func (s *Store) ListAuditLogs(_ context.Context, limit int) ([]domain.AuditLog, error) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	if limit <= 0 || limit > len(s.audits) {
+		limit = len(s.audits)
+	}
+	result := make([]domain.AuditLog, 0, limit)
+	for i := len(s.audits) - 1; i >= len(s.audits)-limit; i-- {
+		result = append(result, s.audits[i])
+	}
+	return result, nil
+}
+
+func (s *Store) EnsureBootstrapAdmin(_ context.Context, username, passwordHash, displayName string) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	for _, credential := range s.users {
+		if strings.EqualFold(credential.Username, username) {
+			return nil
+		}
+	}
+	now := time.Now().UTC()
+	id := s.id()
+	s.users[id] = domain.UserCredential{User: domain.User{ID: id, Username: username, DisplayName: displayName, IsAdmin: true, CreatedAt: now}, PasswordHash: passwordHash}
+	s.audit(username, "create", "user", id, map[string]any{"bootstrap": true, "isAdmin": true})
+	return nil
+}
+
+func (s *Store) FindUserByUsername(_ context.Context, username string) (domain.UserCredential, error) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	for _, credential := range s.users {
+		if strings.EqualFold(credential.Username, username) {
+			return credential, nil
+		}
+	}
+	return domain.UserCredential{}, storepkg.ErrNotFound
+}
+
+func (s *Store) ListUsers(context.Context) ([]domain.User, error) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	result := make([]domain.User, 0, len(s.users))
+	for _, credential := range s.users {
+		result = append(result, credential.User)
+	}
+	sort.Slice(result, func(i, j int) bool { return result[i].Username < result[j].Username })
+	return result, nil
+}
+
+func (s *Store) CreateUser(_ context.Context, input domain.User, passwordHash string) (domain.User, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	for _, credential := range s.users {
+		if strings.EqualFold(credential.Username, input.Username) {
+			return domain.User{}, storepkg.ErrConflict
+		}
+	}
+	input.ID, input.CreatedAt = s.id(), time.Now().UTC()
+	s.users[input.ID] = domain.UserCredential{User: input, PasswordHash: passwordHash}
+	s.audit(defaultActor(input.UpdatedBy), "create", "user", input.ID, input)
+	return input, nil
+}
+
+func (s *Store) SetUserAppRole(_ context.Context, input domain.UserAppRole) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if _, ok := s.users[input.UserID]; !ok {
+		return storepkg.ErrNotFound
+	}
+	if _, ok := s.applications[input.AppID]; !ok {
+		return storepkg.ErrNotFound
+	}
+	if input.Role != "admin" && input.Role != "app-owner" && input.Role != "viewer" {
+		return errors.New("invalid role")
+	}
+	s.userRoles[[2]int64{input.UserID, input.AppID}] = input.Role
+	s.audit(defaultActor(input.UpdatedBy), "update", "user_app_role", input.UserID, input)
+	return nil
+}
+
+func (s *Store) DeleteUserAppRole(_ context.Context, userID, appID int64, updatedBy string) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	key := [2]int64{userID, appID}
+	if _, ok := s.userRoles[key]; !ok {
+		return storepkg.ErrNotFound
+	}
+	delete(s.userRoles, key)
+	s.audit(defaultActor(updatedBy), "delete", "user_app_role", userID, map[string]int64{"appId": appID})
+	return nil
+}
+
+func (s *Store) GetUserAppRole(_ context.Context, userID, appID int64) (string, error) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	role, ok := s.userRoles[[2]int64{userID, appID}]
+	if !ok {
+		return "", storepkg.ErrNotFound
+	}
+	return role, nil
+}
+
+func (s *Store) ListUserAppRoles(_ context.Context, userID int64) ([]domain.UserAppRole, error) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	if _, ok := s.users[userID]; !ok {
+		return nil, storepkg.ErrNotFound
+	}
+	result := make([]domain.UserAppRole, 0)
+	for key, role := range s.userRoles {
+		if key[0] == userID {
+			result = append(result, domain.UserAppRole{UserID: userID, AppID: key[1], Role: role})
+		}
+	}
+	sort.Slice(result, func(i, j int) bool { return result[i].AppID < result[j].AppID })
+	return result, nil
+}
+
+func (s *Store) ResolveScope(_ context.Context, envCode, appCode, namespaceName string) (int64, int64, int64, error) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	var appID, namespaceID, envID int64
+	for id, item := range s.applications {
+		if item.Code == appCode {
+			appID = id
+			break
+		}
+	}
+	for id, item := range s.environments {
+		if strings.EqualFold(item.Code, envCode) {
+			envID = id
+			break
+		}
+	}
+	for id, item := range s.namespaces {
+		if item.AppID == appID && item.Name == namespaceName {
+			namespaceID = id
+			break
+		}
+	}
+	if appID == 0 || namespaceID == 0 || envID == 0 {
+		return 0, 0, 0, storepkg.ErrNotFound
+	}
+	return appID, namespaceID, envID, nil
+}
+
+func (s *Store) ListGrayRules(_ context.Context, appID, namespaceID, envID int64) ([]domain.GrayRule, error) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	if !s.validScope(appID, namespaceID, envID) {
+		return nil, storepkg.ErrNotFound
+	}
+	result := make([]domain.GrayRule, 0)
+	for _, rule := range s.grayRules {
+		if rule.AppID == appID && rule.NamespaceID == namespaceID && rule.EnvironmentID == envID {
+			result = append(result, cloneGrayRule(rule))
+		}
+	}
+	sort.Slice(result, func(i, j int) bool {
+		if result[i].Priority == result[j].Priority {
+			return result[i].ID < result[j].ID
+		}
+		return result[i].Priority < result[j].Priority
+	})
+	return result, nil
+}
+
+func (s *Store) GetGrayRule(_ context.Context, id int64) (domain.GrayRule, error) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	rule, ok := s.grayRules[id]
+	if !ok {
+		return domain.GrayRule{}, storepkg.ErrNotFound
+	}
+	return cloneGrayRule(rule), nil
+}
+
+func (s *Store) CreateGrayRule(_ context.Context, input domain.GrayRule, updatedBy string) (domain.GrayRule, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if !s.validScope(input.AppID, input.NamespaceID, input.EnvironmentID) {
+		return domain.GrayRule{}, storepkg.ErrNotFound
+	}
+	input.ID, input.CreatedAt = s.id(), time.Now().UTC()
+	input = cloneGrayRule(input)
+	s.grayRules[input.ID] = input
+	s.audit(defaultActor(updatedBy), "create", "gray_rule", input.ID, input)
+	return cloneGrayRule(input), nil
+}
+
+func (s *Store) UpdateGrayRule(_ context.Context, id int64, input domain.GrayRule, updatedBy string) (domain.GrayRule, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	current, ok := s.grayRules[id]
+	if !ok {
+		return domain.GrayRule{}, storepkg.ErrNotFound
+	}
+	current.RuleType, current.RuleValue, current.Overrides = input.RuleType, append(json.RawMessage(nil), input.RuleValue...), cloneMap(input.Overrides)
+	current.Enabled, current.Priority, current.Desc = input.Enabled, input.Priority, input.Desc
+	s.grayRules[id] = current
+	s.audit(defaultActor(updatedBy), "update", "gray_rule", id, current)
+	return cloneGrayRule(current), nil
+}
+
+func (s *Store) DeleteGrayRule(_ context.Context, id int64, updatedBy string) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if _, ok := s.grayRules[id]; !ok {
+		return storepkg.ErrNotFound
+	}
+	delete(s.grayRules, id)
+	s.audit(defaultActor(updatedBy), "delete", "gray_rule", id, nil)
+	return nil
+}
+
+func (s *Store) ClaimOutbox(_ context.Context, limit int) ([]domain.OutboxEntry, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	now := time.Now().UTC()
+	ids := make([]int64, 0)
+	for id, record := range s.outbox {
+		if record.Status == "pending" && !record.NextAttempt.After(now) {
+			ids = append(ids, id)
+		}
+	}
+	sort.Slice(ids, func(i, j int) bool { return ids[i] < ids[j] })
+	if len(ids) > limit {
+		ids = ids[:limit]
+	}
+	result := make([]domain.OutboxEntry, 0, len(ids))
+	for _, id := range ids {
+		record := s.outbox[id]
+		record.Status = "processing"
+		s.outbox[id] = record
+		result = append(result, record.OutboxEntry)
+	}
+	return result, nil
+}
+
+func (s *Store) MarkOutboxDone(_ context.Context, id, releaseID, revision int64) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	record, ok := s.outbox[id]
+	if !ok {
+		return storepkg.ErrNotFound
+	}
+	record.Status = "done"
+	s.outbox[id] = record
+	release, ok := s.releases[releaseID]
+	if !ok {
+		return storepkg.ErrNotFound
+	}
+	release.Status, release.EtcdRevision = "applied", &revision
+	s.releases[releaseID] = release
+	return nil
+}
+
+func (s *Store) MarkOutboxFailed(_ context.Context, id, releaseID int64, _ string, maxRetry int) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	record, ok := s.outbox[id]
+	if !ok {
+		return storepkg.ErrNotFound
+	}
+	record.RetryCount++
+	if record.RetryCount >= maxRetry {
+		record.Status = "failed"
+		if release, exists := s.releases[releaseID]; exists {
+			release.Status = "failed"
+			s.releases[releaseID] = release
+		}
+	} else {
+		record.Status = "pending"
+		delay := time.Duration(1<<min(record.RetryCount, 6)) * time.Second
+		record.NextAttempt = time.Now().UTC().Add(delay)
+	}
+	s.outbox[id] = record
+	return nil
+}
+
+func (s *Store) OutboxStats(context.Context) (domain.OutboxStats, error) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	var result domain.OutboxStats
+	for _, record := range s.outbox {
+		switch record.Status {
+		case "pending":
+			result.Pending++
+		case "processing":
+			result.Processing++
+		case "failed":
+			result.Failed++
+		}
+	}
+	return result, nil
+}
+
+func (s *Store) validScope(appID, namespaceID, envID int64) bool {
+	ns, ok := s.namespaces[namespaceID]
+	_, envExists := s.environments[envID]
+	_, appExists := s.applications[appID]
+	return ok && ns.AppID == appID && envExists && appExists
+}
+
+func (s *Store) scopeItems(appID, namespaceID, envID int64) []domain.ConfigItem {
+	result := make([]domain.ConfigItem, 0)
+	for _, item := range s.configs {
+		if item.AppID == appID && item.NamespaceID == namespaceID && item.EnvironmentID == envID {
+			result = append(result, item)
+		}
+	}
+	return result
+}
+
+func (s *Store) newRelease(appID, namespaceID, envID int64, snapshot map[string]string, added, modified, removed int, comment, operator string) domain.Release {
+	version := 1
+	for _, release := range s.releases {
+		if release.NamespaceID == namespaceID && release.EnvironmentID == envID && release.Version >= version {
+			version = release.Version + 1
+		}
+	}
+	release := domain.Release{ID: s.id(), AppID: appID, NamespaceID: namespaceID, EnvironmentID: envID, Version: version, Snapshot: snapshot, Added: added, Modified: modified, Removed: removed, Comment: comment, Operator: operator, Status: "pending", Time: time.Now().UTC()}
+	s.releases[release.ID] = release
+	return release
+}
+
+func (s *Store) enqueue(release domain.Release) {
+	app := s.applications[release.AppID]
+	ns := s.namespaces[release.NamespaceID]
+	env := s.environments[release.EnvironmentID]
+	payload, _ := json.Marshal(release.Snapshot)
+	id := s.id()
+	s.outbox[id] = outboxRecord{OutboxEntry: domain.OutboxEntry{ID: id, ReleaseID: release.ID, EtcdKey: fmt.Sprintf("/config/%s/%s/%s", strings.ToLower(env.Code), app.Code, ns.Name), Payload: payload}, Status: "pending"}
+}
+
+func (s *Store) audit(actor, action, targetType string, targetID int64, detail any) {
+	payload, _ := json.Marshal(detail)
+	id := s.id()
+	target := targetID
+	s.audits = append(s.audits, domain.AuditLog{ID: id, Actor: defaultActor(actor), Action: action, TargetType: targetType, TargetID: &target, Detail: payload, CreatedAt: time.Now().UTC()})
+}
+
+func diff(current, target map[string]string) (added, modified, removed int) {
+	for key, value := range target {
+		old, ok := current[key]
+		if !ok {
+			added++
+		} else if old != value {
+			modified++
+		}
+	}
+	for key := range current {
+		if _, ok := target[key]; !ok {
+			removed++
+		}
+	}
+	return
+}
+
+func cloneMap(input map[string]string) map[string]string {
+	result := make(map[string]string, len(input))
+	for key, value := range input {
+		result[key] = value
+	}
+	return result
+}
+
+func cloneGrayRule(input domain.GrayRule) domain.GrayRule {
+	input.RuleValue = append(json.RawMessage(nil), input.RuleValue...)
+	input.Overrides = cloneMap(input.Overrides)
+	return input
+}
+
+func defaultActor(actor string) string {
+	if strings.TrimSpace(actor) == "" {
+		return "admin"
+	}
+	return strings.TrimSpace(actor)
+}
diff --git a/internal/store/memory/memory_test.go b/internal/store/memory/memory_test.go
new file mode 100644
index 0000000..97a7c93
--- /dev/null
+++ b/internal/store/memory/memory_test.go
@@ -0,0 +1,80 @@
+package memory
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"github.com/longpeng/configcenter/internal/domain"
+	storepkg "github.com/longpeng/configcenter/internal/store"
+)
+
+func TestPublishCreatesVersionSnapshotAndOutbox(t *testing.T) {
+	repository := New(false)
+	ctx := context.Background()
+	app, err := repository.CreateApplication(ctx, domain.Application{Code: "orders", Name: "Orders"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	env, err := repository.CreateEnvironment(ctx, domain.Environment{Code: "PROD", Name: "Production", Order: 1})
+	if err != nil {
+		t.Fatal(err)
+	}
+	ns, err := repository.CreateNamespace(ctx, domain.Namespace{AppID: app.ID, Name: "application", Type: "properties"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	item, err := repository.CreateConfigItem(ctx, domain.ConfigItem{AppID: app.ID, NamespaceID: ns.ID, EnvironmentID: env.ID, Key: "server.port", Value: "8080", UpdatedBy: "alice"})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	release, err := repository.Publish(ctx, domain.PublishRequest{AppID: app.ID, NamespaceID: ns.ID, EnvironmentID: env.ID, Comment: "first", Operator: "alice"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if release.Version != 1 || release.Added != 1 || release.Snapshot["server.port"] != "8080" || release.Status != "pending" {
+		t.Fatalf("unexpected release: %#v", release)
+	}
+	items, err := repository.ListConfigItems(ctx, app.ID, ns.ID, env.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(items) != 1 || items[0].ReleasedValue == nil || *items[0].ReleasedValue != item.Value {
+		t.Fatalf("published item was not marked released: %#v", items)
+	}
+	entries, err := repository.ClaimOutbox(ctx, 10)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(entries) != 1 || entries[0].ReleaseID != release.ID || entries[0].EtcdKey != "/config/prod/orders/application" {
+		t.Fatalf("unexpected outbox: %#v", entries)
+	}
+	if _, err := repository.Publish(ctx, domain.PublishRequest{AppID: app.ID, NamespaceID: ns.ID, EnvironmentID: env.ID}); !errors.Is(err, storepkg.ErrNoPendingChange) {
+		t.Fatalf("expected no pending changes, got %v", err)
+	}
+}
+
+func TestRollbackCreatesANewRelease(t *testing.T) {
+	repository := New(false)
+	ctx := context.Background()
+	app, _ := repository.CreateApplication(ctx, domain.Application{Code: "orders", Name: "Orders"})
+	env, _ := repository.CreateEnvironment(ctx, domain.Environment{Code: "PROD", Name: "Production"})
+	ns, _ := repository.CreateNamespace(ctx, domain.Namespace{AppID: app.ID, Name: "application", Type: "properties"})
+	item, _ := repository.CreateConfigItem(ctx, domain.ConfigItem{AppID: app.ID, NamespaceID: ns.ID, EnvironmentID: env.ID, Key: "feature", Value: "off"})
+	first, _ := repository.Publish(ctx, domain.PublishRequest{AppID: app.ID, NamespaceID: ns.ID, EnvironmentID: env.ID, Operator: "alice"})
+	_, _ = repository.UpdateConfigItem(ctx, item.ID, domain.ConfigItem{Value: "on", UpdatedBy: "bob"})
+	second, _ := repository.Publish(ctx, domain.PublishRequest{AppID: app.ID, NamespaceID: ns.ID, EnvironmentID: env.ID, Operator: "bob"})
+
+	rolledBack, err := repository.Rollback(ctx, domain.RollbackRequest{AppID: app.ID, NamespaceID: ns.ID, EnvironmentID: env.ID, TargetVersion: first.Version, Operator: "carol"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if rolledBack.Version != second.Version+1 || rolledBack.Snapshot["feature"] != "off" || rolledBack.Modified != 1 {
+		t.Fatalf("unexpected rollback release: %#v", rolledBack)
+	}
+	releases, _ := repository.ListReleases(ctx, app.ID, ns.ID, env.ID)
+	if len(releases) != 3 {
+		t.Fatalf("rollback must retain history, got %d releases", len(releases))
+	}
+}
diff --git a/internal/store/postgres/migrations/001_init.sql b/internal/store/postgres/migrations/001_init.sql
new file mode 100644
index 0000000..084fcbd
--- /dev/null
+++ b/internal/store/postgres/migrations/001_init.sql
@@ -0,0 +1,134 @@
+CREATE TABLE IF NOT EXISTS applications (
+    id            BIGSERIAL PRIMARY KEY,
+    app_code      VARCHAR(64) UNIQUE NOT NULL,
+    name          VARCHAR(128) NOT NULL,
+    department    VARCHAR(128) NOT NULL DEFAULT '',
+    owner         VARCHAR(64) NOT NULL DEFAULT '',
+    description   TEXT NOT NULL DEFAULT '',
+    created_at    TIMESTAMPTZ NOT NULL DEFAULT now(),
+    updated_at    TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS environments (
+    id            BIGSERIAL PRIMARY KEY,
+    env_code      VARCHAR(32) UNIQUE NOT NULL,
+    name          VARCHAR(64) NOT NULL,
+    sort_order    INT NOT NULL DEFAULT 0,
+    description   TEXT NOT NULL DEFAULT ''
+);
+
+CREATE TABLE IF NOT EXISTS namespaces (
+    id            BIGSERIAL PRIMARY KEY,
+    app_id        BIGINT NOT NULL REFERENCES applications(id) ON DELETE CASCADE,
+    name          VARCHAR(64) NOT NULL,
+    format        VARCHAR(16) NOT NULL DEFAULT 'properties',
+    description   TEXT NOT NULL DEFAULT '',
+    UNIQUE(app_id, name),
+    CONSTRAINT namespaces_format_check CHECK (format IN ('properties', 'yaml', 'json', 'xml'))
+);
+
+CREATE TABLE IF NOT EXISTS config_items (
+    id             BIGSERIAL PRIMARY KEY,
+    namespace_id   BIGINT NOT NULL REFERENCES namespaces(id) ON DELETE CASCADE,
+    env_id         BIGINT NOT NULL REFERENCES environments(id) ON DELETE CASCADE,
+    key            VARCHAR(256) NOT NULL,
+    value          TEXT NOT NULL,
+    released_value TEXT,
+    pending_delete BOOLEAN NOT NULL DEFAULT false,
+    comment        TEXT NOT NULL DEFAULT '',
+    updated_by     VARCHAR(64) NOT NULL DEFAULT 'admin',
+    updated_at     TIMESTAMPTZ NOT NULL DEFAULT now(),
+    UNIQUE(namespace_id, env_id, key)
+);
+
+CREATE TABLE IF NOT EXISTS releases (
+    id            BIGSERIAL PRIMARY KEY,
+    namespace_id  BIGINT NOT NULL REFERENCES namespaces(id) ON DELETE CASCADE,
+    env_id        BIGINT NOT NULL REFERENCES environments(id) ON DELETE CASCADE,
+    version       INT NOT NULL,
+    snapshot      JSONB NOT NULL,
+    diff_added    INT NOT NULL DEFAULT 0,
+    diff_modified INT NOT NULL DEFAULT 0,
+    diff_removed  INT NOT NULL DEFAULT 0,
+    comment       TEXT NOT NULL DEFAULT '',
+    operator      VARCHAR(64) NOT NULL,
+    etcd_revision BIGINT,
+    status        VARCHAR(16) NOT NULL DEFAULT 'pending',
+    created_at    TIMESTAMPTZ NOT NULL DEFAULT now(),
+    UNIQUE(namespace_id, env_id, version),
+    CONSTRAINT releases_status_check CHECK (status IN ('pending', 'applied', 'failed'))
+);
+
+CREATE TABLE IF NOT EXISTS release_outbox (
+    id              BIGSERIAL PRIMARY KEY,
+    release_id      BIGINT NOT NULL REFERENCES releases(id) ON DELETE CASCADE,
+    etcd_key         VARCHAR(512) NOT NULL,
+    payload          JSONB NOT NULL,
+    status           VARCHAR(16) NOT NULL DEFAULT 'pending',
+    retry_count      INT NOT NULL DEFAULT 0,
+    last_error       TEXT NOT NULL DEFAULT '',
+    next_attempt_at  TIMESTAMPTZ NOT NULL DEFAULT now(),
+    locked_at        TIMESTAMPTZ,
+    created_at       TIMESTAMPTZ NOT NULL DEFAULT now(),
+    CONSTRAINT outbox_status_check CHECK (status IN ('pending', 'processing', 'done', 'failed'))
+);
+
+CREATE INDEX IF NOT EXISTS release_outbox_poll_idx
+    ON release_outbox(status, next_attempt_at, id);
+CREATE INDEX IF NOT EXISTS releases_scope_idx
+    ON releases(namespace_id, env_id, version DESC);
+CREATE INDEX IF NOT EXISTS config_items_scope_idx
+    ON config_items(namespace_id, env_id, key);
+
+CREATE TABLE IF NOT EXISTS users (
+    id            BIGSERIAL PRIMARY KEY,
+    username      VARCHAR(64) UNIQUE NOT NULL,
+    password_hash VARCHAR(256) NOT NULL,
+    display_name  VARCHAR(64) NOT NULL DEFAULT '',
+    created_at    TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS roles (
+    id   BIGSERIAL PRIMARY KEY,
+    name VARCHAR(32) UNIQUE NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS user_app_roles (
+    user_id BIGINT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    app_id  BIGINT NOT NULL REFERENCES applications(id) ON DELETE CASCADE,
+    role_id BIGINT NOT NULL REFERENCES roles(id) ON DELETE CASCADE,
+    PRIMARY KEY (user_id, app_id)
+);
+
+CREATE TABLE IF NOT EXISTS audit_logs (
+    id           BIGSERIAL PRIMARY KEY,
+    actor        VARCHAR(64) NOT NULL,
+    action       VARCHAR(32) NOT NULL,
+    target_type  VARCHAR(32) NOT NULL,
+    target_id    BIGINT,
+    detail       JSONB,
+    created_at   TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS audit_logs_created_idx ON audit_logs(created_at DESC);
+
+CREATE TABLE IF NOT EXISTS gray_rules (
+    id            BIGSERIAL PRIMARY KEY,
+    namespace_id  BIGINT NOT NULL REFERENCES namespaces(id) ON DELETE CASCADE,
+    env_id        BIGINT NOT NULL REFERENCES environments(id) ON DELETE CASCADE,
+    rule_type     VARCHAR(16) NOT NULL,
+    rule_value    JSONB NOT NULL,
+    overrides     JSONB NOT NULL,
+    enabled       BOOLEAN NOT NULL DEFAULT true,
+    created_at    TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+INSERT INTO environments(env_code, name, sort_order, description) VALUES
+    ('DEV', '开发环境', 1, '开发联调使用'),
+    ('TEST', '测试环境', 2, 'QA 测试验证'),
+    ('STAGING', '预发环境', 3, '上线前灰度验证'),
+    ('PROD', '生产环境', 4, '线上正式环境')
+ON CONFLICT (env_code) DO NOTHING;
+
+INSERT INTO roles(name) VALUES ('admin'), ('app-owner'), ('viewer')
+ON CONFLICT (name) DO NOTHING;
diff --git a/internal/store/postgres/migrations/002_auth_gray.sql b/internal/store/postgres/migrations/002_auth_gray.sql
new file mode 100644
index 0000000..d7be592
--- /dev/null
+++ b/internal/store/postgres/migrations/002_auth_gray.sql
@@ -0,0 +1,10 @@
+ALTER TABLE users ADD COLUMN IF NOT EXISTS is_admin BOOLEAN NOT NULL DEFAULT false;
+ALTER TABLE users ADD COLUMN IF NOT EXISTS disabled BOOLEAN NOT NULL DEFAULT false;
+
+CREATE INDEX IF NOT EXISTS user_app_roles_app_idx ON user_app_roles(app_id, user_id);
+
+ALTER TABLE gray_rules ADD COLUMN IF NOT EXISTS priority INT NOT NULL DEFAULT 0;
+ALTER TABLE gray_rules ADD COLUMN IF NOT EXISTS description TEXT NOT NULL DEFAULT '';
+
+CREATE INDEX IF NOT EXISTS gray_rules_scope_idx
+    ON gray_rules(namespace_id, env_id, enabled, priority, id);
diff --git a/internal/store/postgres/postgres.go b/internal/store/postgres/postgres.go
new file mode 100644
index 0000000..94bd68d
--- /dev/null
+++ b/internal/store/postgres/postgres.go
@@ -0,0 +1,930 @@
+package postgres
+
+import (
+	"context"
+	"embed"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgconn"
+	"github.com/jackc/pgx/v5/pgxpool"
+	"github.com/longpeng/configcenter/internal/domain"
+	storepkg "github.com/longpeng/configcenter/internal/store"
+)
+
+//go:embed migrations/*.sql
+var migrations embed.FS
+
+type Store struct {
+	pool *pgxpool.Pool
+}
+
+func Open(ctx context.Context, databaseURL string) (*Store, error) {
+	pool, err := pgxpool.New(ctx, databaseURL)
+	if err != nil {
+		return nil, fmt.Errorf("create postgres pool: %w", err)
+	}
+	if err := pool.Ping(ctx); err != nil {
+		pool.Close()
+		return nil, fmt.Errorf("ping postgres: %w", err)
+	}
+	return &Store{pool: pool}, nil
+}
+
+func (s *Store) Close() { s.pool.Close() }
+
+func (s *Store) Ping(ctx context.Context) error { return s.pool.Ping(ctx) }
+
+func (s *Store) Migrate(ctx context.Context) error {
+	entries, err := migrations.ReadDir("migrations")
+	if err != nil {
+		return fmt.Errorf("list migrations: %w", err)
+	}
+	for _, entry := range entries {
+		if entry.IsDir() || !strings.HasSuffix(entry.Name(), ".sql") {
+			continue
+		}
+		content, err := migrations.ReadFile("migrations/" + entry.Name())
+		if err != nil {
+			return fmt.Errorf("read migration %s: %w", entry.Name(), err)
+		}
+		if _, err := s.pool.Exec(ctx, string(content)); err != nil {
+			return fmt.Errorf("apply migration %s: %w", entry.Name(), err)
+		}
+	}
+	return nil
+}
+
+func (s *Store) ListApplications(ctx context.Context) ([]domain.Application, error) {
+	rows, err := s.pool.Query(ctx, `SELECT id, app_code, name, department, owner, description, created_at, updated_at FROM applications ORDER BY app_code`)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	result := make([]domain.Application, 0)
+	for rows.Next() {
+		var item domain.Application
+		if err := rows.Scan(&item.ID, &item.Code, &item.Name, &item.Department, &item.Owner, &item.Desc, &item.CreatedAt, &item.UpdatedAt); err != nil {
+			return nil, err
+		}
+		result = append(result, item)
+	}
+	return result, rows.Err()
+}
+
+func (s *Store) CreateApplication(ctx context.Context, input domain.Application) (domain.Application, error) {
+	err := s.pool.QueryRow(ctx, `
+		INSERT INTO applications(app_code, name, department, owner, description)
+		VALUES($1, $2, $3, $4, $5)
+		RETURNING id, app_code, name, department, owner, description, created_at, updated_at`,
+		input.Code, input.Name, input.Department, input.Owner, input.Desc,
+	).Scan(&input.ID, &input.Code, &input.Name, &input.Department, &input.Owner, &input.Desc, &input.CreatedAt, &input.UpdatedAt)
+	if err != nil {
+		return domain.Application{}, classify(err)
+	}
+	s.audit(ctx, actor(input.UpdatedBy), "create", "app", input.ID, input)
+	return input, nil
+}
+
+func (s *Store) UpdateApplication(ctx context.Context, id int64, input domain.Application) (domain.Application, error) {
+	err := s.pool.QueryRow(ctx, `
+		UPDATE applications SET name=$2, department=$3, owner=$4, description=$5, updated_at=now()
+		WHERE id=$1
+		RETURNING id, app_code, name, department, owner, description, created_at, updated_at`,
+		id, input.Name, input.Department, input.Owner, input.Desc,
+	).Scan(&input.ID, &input.Code, &input.Name, &input.Department, &input.Owner, &input.Desc, &input.CreatedAt, &input.UpdatedAt)
+	if err != nil {
+		return domain.Application{}, classify(err)
+	}
+	s.audit(ctx, actor(input.UpdatedBy), "update", "app", id, input)
+	return input, nil
+}
+
+func (s *Store) DeleteApplication(ctx context.Context, id int64, actor string) error {
+	return s.deleteAndAudit(ctx, "applications", "app", id, actor)
+}
+
+func (s *Store) ListEnvironments(ctx context.Context) ([]domain.Environment, error) {
+	rows, err := s.pool.Query(ctx, `SELECT id, env_code, name, sort_order, description FROM environments ORDER BY sort_order, env_code`)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	result := make([]domain.Environment, 0)
+	for rows.Next() {
+		var item domain.Environment
+		if err := rows.Scan(&item.ID, &item.Code, &item.Name, &item.Order, &item.Desc); err != nil {
+			return nil, err
+		}
+		result = append(result, item)
+	}
+	return result, rows.Err()
+}
+
+func (s *Store) CreateEnvironment(ctx context.Context, input domain.Environment) (domain.Environment, error) {
+	input.Code = strings.ToUpper(input.Code)
+	err := s.pool.QueryRow(ctx, `
+		INSERT INTO environments(env_code, name, sort_order, description) VALUES($1, $2, $3, $4)
+		RETURNING id, env_code, name, sort_order, description`, input.Code, input.Name, input.Order, input.Desc,
+	).Scan(&input.ID, &input.Code, &input.Name, &input.Order, &input.Desc)
+	if err != nil {
+		return domain.Environment{}, classify(err)
+	}
+	s.audit(ctx, actor(input.UpdatedBy), "create", "env", input.ID, input)
+	return input, nil
+}
+
+func (s *Store) UpdateEnvironment(ctx context.Context, id int64, input domain.Environment) (domain.Environment, error) {
+	err := s.pool.QueryRow(ctx, `
+		UPDATE environments SET name=$2, sort_order=$3, description=$4 WHERE id=$1
+		RETURNING id, env_code, name, sort_order, description`, id, input.Name, input.Order, input.Desc,
+	).Scan(&input.ID, &input.Code, &input.Name, &input.Order, &input.Desc)
+	if err != nil {
+		return domain.Environment{}, classify(err)
+	}
+	s.audit(ctx, actor(input.UpdatedBy), "update", "env", id, input)
+	return input, nil
+}
+
+func (s *Store) DeleteEnvironment(ctx context.Context, id int64, actor string) error {
+	return s.deleteAndAudit(ctx, "environments", "env", id, actor)
+}
+
+func (s *Store) ListNamespaces(ctx context.Context, appID *int64) ([]domain.Namespace, error) {
+	query := `SELECT id, app_id, name, format, description FROM namespaces`
+	args := []any{}
+	if appID != nil {
+		query += ` WHERE app_id=$1`
+		args = append(args, *appID)
+	}
+	query += ` ORDER BY app_id, name`
+	rows, err := s.pool.Query(ctx, query, args...)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	result := make([]domain.Namespace, 0)
+	for rows.Next() {
+		var item domain.Namespace
+		if err := rows.Scan(&item.ID, &item.AppID, &item.Name, &item.Type, &item.Desc); err != nil {
+			return nil, err
+		}
+		result = append(result, item)
+	}
+	return result, rows.Err()
+}
+
+func (s *Store) GetNamespace(ctx context.Context, id int64) (domain.Namespace, error) {
+	var item domain.Namespace
+	err := s.pool.QueryRow(ctx, `SELECT id, app_id, name, format, description FROM namespaces WHERE id=$1`, id).
+		Scan(&item.ID, &item.AppID, &item.Name, &item.Type, &item.Desc)
+	return item, classify(err)
+}
+
+func (s *Store) CreateNamespace(ctx context.Context, input domain.Namespace) (domain.Namespace, error) {
+	err := s.pool.QueryRow(ctx, `
+		INSERT INTO namespaces(app_id, name, format, description) VALUES($1, $2, $3, $4)
+		RETURNING id, app_id, name, format, description`, input.AppID, input.Name, input.Type, input.Desc,
+	).Scan(&input.ID, &input.AppID, &input.Name, &input.Type, &input.Desc)
+	if err != nil {
+		return domain.Namespace{}, classify(err)
+	}
+	s.audit(ctx, actor(input.UpdatedBy), "create", "namespace", input.ID, input)
+	return input, nil
+}
+
+func (s *Store) UpdateNamespace(ctx context.Context, id int64, input domain.Namespace) (domain.Namespace, error) {
+	err := s.pool.QueryRow(ctx, `
+		UPDATE namespaces SET format=$2, description=$3 WHERE id=$1
+		RETURNING id, app_id, name, format, description`, id, input.Type, input.Desc,
+	).Scan(&input.ID, &input.AppID, &input.Name, &input.Type, &input.Desc)
+	if err != nil {
+		return domain.Namespace{}, classify(err)
+	}
+	s.audit(ctx, actor(input.UpdatedBy), "update", "namespace", id, input)
+	return input, nil
+}
+
+func (s *Store) DeleteNamespace(ctx context.Context, id int64, actor string) error {
+	return s.deleteAndAudit(ctx, "namespaces", "namespace", id, actor)
+}
+
+func (s *Store) ListConfigItems(ctx context.Context, appID, namespaceID, envID int64) ([]domain.ConfigItem, error) {
+	rows, err := s.pool.Query(ctx, `
+		SELECT ci.id, n.app_id, ci.namespace_id, ci.env_id, ci.key, ci.value, ci.released_value,
+		       ci.pending_delete, ci.comment, ci.updated_by, ci.updated_at
+		FROM config_items ci JOIN namespaces n ON n.id=ci.namespace_id
+		WHERE n.app_id=$1 AND ci.namespace_id=$2 AND ci.env_id=$3 ORDER BY ci.key`, appID, namespaceID, envID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	result := make([]domain.ConfigItem, 0)
+	for rows.Next() {
+		item, err := scanConfig(rows)
+		if err != nil {
+			return nil, err
+		}
+		result = append(result, item)
+	}
+	return result, rows.Err()
+}
+
+func (s *Store) GetConfigItem(ctx context.Context, id int64) (domain.ConfigItem, error) {
+	row := s.pool.QueryRow(ctx, `
+		SELECT ci.id, n.app_id, ci.namespace_id, ci.env_id, ci.key, ci.value, ci.released_value,
+		       ci.pending_delete, ci.comment, ci.updated_by, ci.updated_at
+		FROM config_items ci JOIN namespaces n ON n.id=ci.namespace_id WHERE ci.id=$1`, id)
+	item, err := scanConfig(row)
+	return item, classify(err)
+}
+
+func (s *Store) CreateConfigItem(ctx context.Context, input domain.ConfigItem) (domain.ConfigItem, error) {
+	err := s.pool.QueryRow(ctx, `
+		INSERT INTO config_items(namespace_id, env_id, key, value, comment, updated_by)
+		SELECT n.id, $3, $4, $5, $6, $7 FROM namespaces n WHERE n.id=$2 AND n.app_id=$1
+		RETURNING id, namespace_id, env_id, key, value, released_value, pending_delete, comment, updated_by, updated_at`,
+		input.AppID, input.NamespaceID, input.EnvironmentID, input.Key, input.Value, input.Comment, actor(input.UpdatedBy),
+	).Scan(&input.ID, &input.NamespaceID, &input.EnvironmentID, &input.Key, &input.Value, &input.ReleasedValue, &input.PendingDelete, &input.Comment, &input.UpdatedBy, &input.UpdatedAt)
+	if err != nil {
+		return domain.ConfigItem{}, classify(err)
+	}
+	s.audit(ctx, input.UpdatedBy, "create", "config", input.ID, input)
+	return input, nil
+}
+
+func (s *Store) UpdateConfigItem(ctx context.Context, id int64, input domain.ConfigItem) (domain.ConfigItem, error) {
+	err := s.pool.QueryRow(ctx, `
+		UPDATE config_items SET value=$2, comment=$3, updated_by=$4, updated_at=now(), pending_delete=false WHERE id=$1
+		RETURNING id, namespace_id, env_id, key, value, released_value, pending_delete, comment, updated_by, updated_at`,
+		id, input.Value, input.Comment, actor(input.UpdatedBy),
+	).Scan(&input.ID, &input.NamespaceID, &input.EnvironmentID, &input.Key, &input.Value, &input.ReleasedValue, &input.PendingDelete, &input.Comment, &input.UpdatedBy, &input.UpdatedAt)
+	if err != nil {
+		return domain.ConfigItem{}, classify(err)
+	}
+	if err := s.pool.QueryRow(ctx, `SELECT app_id FROM namespaces WHERE id=$1`, input.NamespaceID).Scan(&input.AppID); err != nil {
+		return domain.ConfigItem{}, err
+	}
+	s.audit(ctx, input.UpdatedBy, "update", "config", id, input)
+	return input, nil
+}
+
+func (s *Store) SetConfigItemPendingDelete(ctx context.Context, id int64, pending bool, updatedBy string) (domain.ConfigItem, error) {
+	tx, err := s.pool.Begin(ctx)
+	if err != nil {
+		return domain.ConfigItem{}, err
+	}
+	defer tx.Rollback(ctx) //nolint:errcheck
+	var released *string
+	if err := tx.QueryRow(ctx, `SELECT released_value FROM config_items WHERE id=$1 FOR UPDATE`, id).Scan(&released); err != nil {
+		return domain.ConfigItem{}, classify(err)
+	}
+	if released == nil && pending {
+		if _, err := tx.Exec(ctx, `DELETE FROM config_items WHERE id=$1`, id); err != nil {
+			return domain.ConfigItem{}, err
+		}
+		if err := insertAudit(ctx, tx, actor(updatedBy), "delete", "config", id, map[string]bool{"draftOnly": true}); err != nil {
+			return domain.ConfigItem{}, err
+		}
+		if err := tx.Commit(ctx); err != nil {
+			return domain.ConfigItem{}, err
+		}
+		return domain.ConfigItem{ID: id}, nil
+	}
+	var item domain.ConfigItem
+	err = tx.QueryRow(ctx, `
+		UPDATE config_items SET pending_delete=$2, updated_by=$3, updated_at=now() WHERE id=$1
+		RETURNING id, namespace_id, env_id, key, value, released_value, pending_delete, comment, updated_by, updated_at`,
+		id, pending, actor(updatedBy),
+	).Scan(&item.ID, &item.NamespaceID, &item.EnvironmentID, &item.Key, &item.Value, &item.ReleasedValue, &item.PendingDelete, &item.Comment, &item.UpdatedBy, &item.UpdatedAt)
+	if err != nil {
+		return domain.ConfigItem{}, classify(err)
+	}
+	if err := tx.QueryRow(ctx, `SELECT app_id FROM namespaces WHERE id=$1`, item.NamespaceID).Scan(&item.AppID); err != nil {
+		return domain.ConfigItem{}, err
+	}
+	if err := insertAudit(ctx, tx, item.UpdatedBy, "update", "config", id, map[string]bool{"pendingDelete": pending}); err != nil {
+		return domain.ConfigItem{}, err
+	}
+	if err := tx.Commit(ctx); err != nil {
+		return domain.ConfigItem{}, err
+	}
+	return item, nil
+}
+
+func (s *Store) Publish(ctx context.Context, request domain.PublishRequest) (domain.Release, error) {
+	tx, err := s.pool.BeginTx(ctx, pgx.TxOptions{IsoLevel: pgx.ReadCommitted})
+	if err != nil {
+		return domain.Release{}, err
+	}
+	defer tx.Rollback(ctx) //nolint:errcheck
+	if _, err := tx.Exec(ctx, `SELECT pg_advisory_xact_lock($1)`, advisoryKey(request.NamespaceID, request.EnvironmentID)); err != nil {
+		return domain.Release{}, err
+	}
+	appCode, namespaceName, envCode, err := loadScope(ctx, tx, request.AppID, request.NamespaceID, request.EnvironmentID)
+	if err != nil {
+		return domain.Release{}, classify(err)
+	}
+	items, err := listConfigTx(ctx, tx, request.AppID, request.NamespaceID, request.EnvironmentID, true)
+	if err != nil {
+		return domain.Release{}, err
+	}
+	snapshot := make(map[string]string)
+	added, modified, removed := 0, 0, 0
+	for _, item := range items {
+		if item.PendingDelete {
+			removed++
+			continue
+		}
+		snapshot[item.Key] = item.Value
+		if item.ReleasedValue == nil {
+			added++
+		} else if *item.ReleasedValue != item.Value {
+			modified++
+		}
+	}
+	if added+modified+removed == 0 {
+		return domain.Release{}, storepkg.ErrNoPendingChange
+	}
+	version, err := nextVersion(ctx, tx, request.NamespaceID, request.EnvironmentID)
+	if err != nil {
+		return domain.Release{}, err
+	}
+	release, err := insertRelease(ctx, tx, request.AppID, request.NamespaceID, request.EnvironmentID, version, snapshot, added, modified, removed, request.Comment, actor(request.Operator))
+	if err != nil {
+		return domain.Release{}, err
+	}
+	key := fmt.Sprintf("/config/%s/%s/%s", strings.ToLower(envCode), appCode, namespaceName)
+	if _, err := tx.Exec(ctx, `INSERT INTO release_outbox(release_id, etcd_key, payload) VALUES($1, $2, $3)`, release.ID, key, snapshot); err != nil {
+		return domain.Release{}, err
+	}
+	if _, err := tx.Exec(ctx, `DELETE FROM config_items WHERE namespace_id=$1 AND env_id=$2 AND pending_delete=true`, request.NamespaceID, request.EnvironmentID); err != nil {
+		return domain.Release{}, err
+	}
+	if _, err := tx.Exec(ctx, `UPDATE config_items SET released_value=value, pending_delete=false WHERE namespace_id=$1 AND env_id=$2`, request.NamespaceID, request.EnvironmentID); err != nil {
+		return domain.Release{}, err
+	}
+	if err := insertAudit(ctx, tx, release.Operator, "publish", "release", release.ID, release); err != nil {
+		return domain.Release{}, err
+	}
+	if err := tx.Commit(ctx); err != nil {
+		return domain.Release{}, err
+	}
+	return release, nil
+}
+
+func (s *Store) Rollback(ctx context.Context, request domain.RollbackRequest) (domain.Release, error) {
+	tx, err := s.pool.Begin(ctx)
+	if err != nil {
+		return domain.Release{}, err
+	}
+	defer tx.Rollback(ctx) //nolint:errcheck
+	if _, err := tx.Exec(ctx, `SELECT pg_advisory_xact_lock($1)`, advisoryKey(request.NamespaceID, request.EnvironmentID)); err != nil {
+		return domain.Release{}, err
+	}
+	appCode, namespaceName, envCode, err := loadScope(ctx, tx, request.AppID, request.NamespaceID, request.EnvironmentID)
+	if err != nil {
+		return domain.Release{}, classify(err)
+	}
+	var targetSnapshot, currentSnapshot map[string]string
+	var targetVersion int
+	err = tx.QueryRow(ctx, `SELECT version, snapshot FROM releases WHERE namespace_id=$1 AND env_id=$2 AND version=$3`, request.NamespaceID, request.EnvironmentID, request.TargetVersion).Scan(&targetVersion, &targetSnapshot)
+	if err != nil {
+		return domain.Release{}, classify(err)
+	}
+	var latestVersion int
+	err = tx.QueryRow(ctx, `SELECT version, snapshot FROM releases WHERE namespace_id=$1 AND env_id=$2 ORDER BY version DESC LIMIT 1`, request.NamespaceID, request.EnvironmentID).Scan(&latestVersion, &currentSnapshot)
+	if err != nil {
+		return domain.Release{}, classify(err)
+	}
+	if latestVersion == targetVersion {
+		return domain.Release{}, storepkg.ErrInvalidRollback
+	}
+	added, modified, removed := diff(currentSnapshot, targetSnapshot)
+	if _, err := tx.Exec(ctx, `DELETE FROM config_items WHERE namespace_id=$1 AND env_id=$2`, request.NamespaceID, request.EnvironmentID); err != nil {
+		return domain.Release{}, err
+	}
+	for key, value := range targetSnapshot {
+		if _, err := tx.Exec(ctx, `INSERT INTO config_items(namespace_id, env_id, key, value, released_value, updated_by) VALUES($1,$2,$3,$4,$4,$5)`, request.NamespaceID, request.EnvironmentID, key, value, actor(request.Operator)); err != nil {
+			return domain.Release{}, err
+		}
+	}
+	version := latestVersion + 1
+	comment := fmt.Sprintf("回滚至版本 v%d", targetVersion)
+	release, err := insertRelease(ctx, tx, request.AppID, request.NamespaceID, request.EnvironmentID, version, targetSnapshot, added, modified, removed, comment, actor(request.Operator))
+	if err != nil {
+		return domain.Release{}, err
+	}
+	key := fmt.Sprintf("/config/%s/%s/%s", strings.ToLower(envCode), appCode, namespaceName)
+	if _, err := tx.Exec(ctx, `INSERT INTO release_outbox(release_id, etcd_key, payload) VALUES($1,$2,$3)`, release.ID, key, targetSnapshot); err != nil {
+		return domain.Release{}, err
+	}
+	if err := insertAudit(ctx, tx, release.Operator, "rollback", "release", release.ID, map[string]int{"targetVersion": targetVersion, "newVersion": version}); err != nil {
+		return domain.Release{}, err
+	}
+	if err := tx.Commit(ctx); err != nil {
+		return domain.Release{}, err
+	}
+	return release, nil
+}
+
+func (s *Store) ListReleases(ctx context.Context, appID, namespaceID, envID int64) ([]domain.Release, error) {
+	rows, err := s.pool.Query(ctx, `
+		SELECT r.id, n.app_id, r.namespace_id, r.env_id, r.version, r.snapshot, r.diff_added, r.diff_modified,
+		       r.diff_removed, r.comment, r.operator, r.etcd_revision, r.status, r.created_at
+		FROM releases r JOIN namespaces n ON n.id=r.namespace_id
+		WHERE n.app_id=$1 AND r.namespace_id=$2 AND r.env_id=$3 ORDER BY r.version DESC`, appID, namespaceID, envID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	result := make([]domain.Release, 0)
+	for rows.Next() {
+		item, err := scanRelease(rows)
+		if err != nil {
+			return nil, err
+		}
+		result = append(result, item)
+	}
+	return result, rows.Err()
+}
+
+func (s *Store) GetRelease(ctx context.Context, id int64) (domain.Release, error) {
+	row := s.pool.QueryRow(ctx, `
+		SELECT r.id, n.app_id, r.namespace_id, r.env_id, r.version, r.snapshot, r.diff_added, r.diff_modified,
+		       r.diff_removed, r.comment, r.operator, r.etcd_revision, r.status, r.created_at
+		FROM releases r JOIN namespaces n ON n.id=r.namespace_id WHERE r.id=$1`, id)
+	item, err := scanRelease(row)
+	return item, classify(err)
+}
+
+func (s *Store) ListAuditLogs(ctx context.Context, limit int) ([]domain.AuditLog, error) {
+	if limit <= 0 || limit > 500 {
+		limit = 100
+	}
+	rows, err := s.pool.Query(ctx, `SELECT id, actor, action, target_type, target_id, detail, created_at FROM audit_logs ORDER BY created_at DESC LIMIT $1`, limit)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	result := make([]domain.AuditLog, 0)
+	for rows.Next() {
+		var item domain.AuditLog
+		if err := rows.Scan(&item.ID, &item.Actor, &item.Action, &item.TargetType, &item.TargetID, &item.Detail, &item.CreatedAt); err != nil {
+			return nil, err
+		}
+		result = append(result, item)
+	}
+	return result, rows.Err()
+}
+
+func (s *Store) EnsureBootstrapAdmin(ctx context.Context, username, passwordHash, displayName string) error {
+	_, err := s.pool.Exec(ctx, `
+		INSERT INTO users(username, password_hash, display_name, is_admin)
+		VALUES($1,$2,$3,true) ON CONFLICT(username) DO NOTHING`, username, passwordHash, displayName)
+	return classify(err)
+}
+
+func (s *Store) FindUserByUsername(ctx context.Context, username string) (domain.UserCredential, error) {
+	var item domain.UserCredential
+	err := s.pool.QueryRow(ctx, `
+		SELECT id, username, password_hash, display_name, is_admin, disabled, created_at
+		FROM users WHERE lower(username)=lower($1)`, username).
+		Scan(&item.ID, &item.Username, &item.PasswordHash, &item.DisplayName, &item.IsAdmin, &item.Disabled, &item.CreatedAt)
+	return item, classify(err)
+}
+
+func (s *Store) ListUsers(ctx context.Context) ([]domain.User, error) {
+	rows, err := s.pool.Query(ctx, `SELECT id, username, display_name, is_admin, disabled, created_at FROM users ORDER BY username`)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	result := make([]domain.User, 0)
+	for rows.Next() {
+		var item domain.User
+		if err := rows.Scan(&item.ID, &item.Username, &item.DisplayName, &item.IsAdmin, &item.Disabled, &item.CreatedAt); err != nil {
+			return nil, err
+		}
+		result = append(result, item)
+	}
+	return result, rows.Err()
+}
+
+func (s *Store) CreateUser(ctx context.Context, input domain.User, passwordHash string) (domain.User, error) {
+	err := s.pool.QueryRow(ctx, `
+		INSERT INTO users(username, password_hash, display_name, is_admin, disabled)
+		VALUES($1,$2,$3,$4,$5)
+		RETURNING id, username, display_name, is_admin, disabled, created_at`,
+		input.Username, passwordHash, input.DisplayName, input.IsAdmin, input.Disabled,
+	).Scan(&input.ID, &input.Username, &input.DisplayName, &input.IsAdmin, &input.Disabled, &input.CreatedAt)
+	if err != nil {
+		return domain.User{}, classify(err)
+	}
+	s.audit(ctx, actor(input.UpdatedBy), "create", "user", input.ID, input)
+	return input, nil
+}
+
+func (s *Store) SetUserAppRole(ctx context.Context, input domain.UserAppRole) error {
+	command, err := s.pool.Exec(ctx, `
+		INSERT INTO user_app_roles(user_id, app_id, role_id)
+		SELECT $1, $2, r.id FROM roles r WHERE r.name=$3
+		ON CONFLICT(user_id, app_id) DO UPDATE SET role_id=EXCLUDED.role_id`, input.UserID, input.AppID, input.Role)
+	if err != nil {
+		return classify(err)
+	}
+	if command.RowsAffected() == 0 {
+		return storepkg.ErrNotFound
+	}
+	s.audit(ctx, actor(input.UpdatedBy), "update", "user_app_role", input.UserID, input)
+	return nil
+}
+
+func (s *Store) DeleteUserAppRole(ctx context.Context, userID, appID int64, updatedBy string) error {
+	command, err := s.pool.Exec(ctx, `DELETE FROM user_app_roles WHERE user_id=$1 AND app_id=$2`, userID, appID)
+	if err != nil {
+		return err
+	}
+	if command.RowsAffected() == 0 {
+		return storepkg.ErrNotFound
+	}
+	s.audit(ctx, actor(updatedBy), "delete", "user_app_role", userID, map[string]int64{"appId": appID})
+	return nil
+}
+
+func (s *Store) GetUserAppRole(ctx context.Context, userID, appID int64) (string, error) {
+	var role string
+	err := s.pool.QueryRow(ctx, `
+		SELECT r.name FROM user_app_roles uar JOIN roles r ON r.id=uar.role_id
+		WHERE uar.user_id=$1 AND uar.app_id=$2`, userID, appID).Scan(&role)
+	return role, classify(err)
+}
+
+func (s *Store) ListUserAppRoles(ctx context.Context, userID int64) ([]domain.UserAppRole, error) {
+	rows, err := s.pool.Query(ctx, `
+		SELECT uar.user_id, uar.app_id, r.name
+		FROM user_app_roles uar JOIN roles r ON r.id=uar.role_id
+		WHERE uar.user_id=$1 ORDER BY uar.app_id`, userID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	result := make([]domain.UserAppRole, 0)
+	for rows.Next() {
+		var item domain.UserAppRole
+		if err := rows.Scan(&item.UserID, &item.AppID, &item.Role); err != nil {
+			return nil, err
+		}
+		result = append(result, item)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	if len(result) == 0 {
+		var exists bool
+		if err := s.pool.QueryRow(ctx, `SELECT EXISTS(SELECT 1 FROM users WHERE id=$1)`, userID).Scan(&exists); err != nil {
+			return nil, err
+		}
+		if !exists {
+			return nil, storepkg.ErrNotFound
+		}
+	}
+	return result, nil
+}
+
+func (s *Store) ResolveScope(ctx context.Context, envCode, appCode, namespaceName string) (int64, int64, int64, error) {
+	var appID, namespaceID, envID int64
+	err := s.pool.QueryRow(ctx, `
+		SELECT a.id, n.id, e.id
+		FROM applications a JOIN namespaces n ON n.app_id=a.id CROSS JOIN environments e
+		WHERE a.app_code=$1 AND n.name=$2 AND lower(e.env_code)=lower($3)`, appCode, namespaceName, envCode).
+		Scan(&appID, &namespaceID, &envID)
+	return appID, namespaceID, envID, classify(err)
+}
+
+func (s *Store) ListGrayRules(ctx context.Context, appID, namespaceID, envID int64) ([]domain.GrayRule, error) {
+	rows, err := s.pool.Query(ctx, `
+		SELECT g.id, n.app_id, g.namespace_id, g.env_id, g.rule_type, g.rule_value, g.overrides,
+		       g.enabled, g.priority, g.description, g.created_at
+		FROM gray_rules g JOIN namespaces n ON n.id=g.namespace_id
+		WHERE n.app_id=$1 AND g.namespace_id=$2 AND g.env_id=$3
+		ORDER BY g.priority, g.id`, appID, namespaceID, envID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	result := make([]domain.GrayRule, 0)
+	for rows.Next() {
+		item, err := scanGrayRule(rows)
+		if err != nil {
+			return nil, err
+		}
+		result = append(result, item)
+	}
+	return result, rows.Err()
+}
+
+func (s *Store) GetGrayRule(ctx context.Context, id int64) (domain.GrayRule, error) {
+	row := s.pool.QueryRow(ctx, `
+		SELECT g.id, n.app_id, g.namespace_id, g.env_id, g.rule_type, g.rule_value, g.overrides,
+		       g.enabled, g.priority, g.description, g.created_at
+		FROM gray_rules g JOIN namespaces n ON n.id=g.namespace_id WHERE g.id=$1`, id)
+	item, err := scanGrayRule(row)
+	return item, classify(err)
+}
+
+func (s *Store) CreateGrayRule(ctx context.Context, input domain.GrayRule, updatedBy string) (domain.GrayRule, error) {
+	err := s.pool.QueryRow(ctx, `
+		INSERT INTO gray_rules(namespace_id, env_id, rule_type, rule_value, overrides, enabled, priority, description)
+		SELECT n.id, $3, $4, $5, $6, $7, $8, $9 FROM namespaces n
+		WHERE n.id=$2 AND n.app_id=$1
+		RETURNING id, namespace_id, env_id, rule_type, rule_value, overrides, enabled, priority, description, created_at`,
+		input.AppID, input.NamespaceID, input.EnvironmentID, input.RuleType, input.RuleValue, input.Overrides, input.Enabled, input.Priority, input.Desc,
+	).Scan(&input.ID, &input.NamespaceID, &input.EnvironmentID, &input.RuleType, &input.RuleValue, &input.Overrides, &input.Enabled, &input.Priority, &input.Desc, &input.CreatedAt)
+	if err != nil {
+		return domain.GrayRule{}, classify(err)
+	}
+	s.audit(ctx, actor(updatedBy), "create", "gray_rule", input.ID, input)
+	return input, nil
+}
+
+func (s *Store) UpdateGrayRule(ctx context.Context, id int64, input domain.GrayRule, updatedBy string) (domain.GrayRule, error) {
+	err := s.pool.QueryRow(ctx, `
+		UPDATE gray_rules SET rule_type=$2, rule_value=$3, overrides=$4, enabled=$5, priority=$6, description=$7
+		WHERE id=$1
+		RETURNING id, namespace_id, env_id, rule_type, rule_value, overrides, enabled, priority, description, created_at`,
+		id, input.RuleType, input.RuleValue, input.Overrides, input.Enabled, input.Priority, input.Desc,
+	).Scan(&input.ID, &input.NamespaceID, &input.EnvironmentID, &input.RuleType, &input.RuleValue, &input.Overrides, &input.Enabled, &input.Priority, &input.Desc, &input.CreatedAt)
+	if err != nil {
+		return domain.GrayRule{}, classify(err)
+	}
+	if err := s.pool.QueryRow(ctx, `SELECT app_id FROM namespaces WHERE id=$1`, input.NamespaceID).Scan(&input.AppID); err != nil {
+		return domain.GrayRule{}, classify(err)
+	}
+	s.audit(ctx, actor(updatedBy), "update", "gray_rule", id, input)
+	return input, nil
+}
+
+func (s *Store) DeleteGrayRule(ctx context.Context, id int64, updatedBy string) error {
+	command, err := s.pool.Exec(ctx, `DELETE FROM gray_rules WHERE id=$1`, id)
+	if err != nil {
+		return err
+	}
+	if command.RowsAffected() == 0 {
+		return storepkg.ErrNotFound
+	}
+	s.audit(ctx, actor(updatedBy), "delete", "gray_rule", id, nil)
+	return nil
+}
+
+func (s *Store) ClaimOutbox(ctx context.Context, limit int) ([]domain.OutboxEntry, error) {
+	tx, err := s.pool.Begin(ctx)
+	if err != nil {
+		return nil, err
+	}
+	defer tx.Rollback(ctx) //nolint:errcheck
+	rows, err := tx.Query(ctx, `
+		SELECT id, release_id, etcd_key, payload, retry_count
+		FROM release_outbox
+		WHERE (status='pending' AND next_attempt_at <= now())
+		   OR (status='processing' AND locked_at < now() - interval '60 seconds')
+		ORDER BY id FOR UPDATE SKIP LOCKED LIMIT $1`, limit)
+	if err != nil {
+		return nil, err
+	}
+	entries := make([]domain.OutboxEntry, 0)
+	ids := make([]int64, 0)
+	for rows.Next() {
+		var entry domain.OutboxEntry
+		if err := rows.Scan(&entry.ID, &entry.ReleaseID, &entry.EtcdKey, &entry.Payload, &entry.RetryCount); err != nil {
+			rows.Close()
+			return nil, err
+		}
+		entries, ids = append(entries, entry), append(ids, entry.ID)
+	}
+	rows.Close()
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	for _, id := range ids {
+		if _, err := tx.Exec(ctx, `UPDATE release_outbox SET status='processing', locked_at=now() WHERE id=$1`, id); err != nil {
+			return nil, err
+		}
+	}
+	if err := tx.Commit(ctx); err != nil {
+		return nil, err
+	}
+	return entries, nil
+}
+
+func (s *Store) MarkOutboxDone(ctx context.Context, id, releaseID, revision int64) error {
+	tx, err := s.pool.Begin(ctx)
+	if err != nil {
+		return err
+	}
+	defer tx.Rollback(ctx) //nolint:errcheck
+	if _, err := tx.Exec(ctx, `UPDATE release_outbox SET status='done', locked_at=NULL WHERE id=$1`, id); err != nil {
+		return err
+	}
+	if _, err := tx.Exec(ctx, `UPDATE releases SET status='applied', etcd_revision=$2 WHERE id=$1`, releaseID, revision); err != nil {
+		return err
+	}
+	return tx.Commit(ctx)
+}
+
+func (s *Store) MarkOutboxFailed(ctx context.Context, id, releaseID int64, message string, maxRetry int) error {
+	tx, err := s.pool.Begin(ctx)
+	if err != nil {
+		return err
+	}
+	defer tx.Rollback(ctx) //nolint:errcheck
+	var status string
+	err = tx.QueryRow(ctx, `
+		UPDATE release_outbox
+		SET retry_count=retry_count+1,
+		    status=CASE WHEN retry_count+1 >= $3 THEN 'failed' ELSE 'pending' END,
+		    last_error=$2,
+		    next_attempt_at=now() + make_interval(secs => power(2, LEAST(retry_count+1, 6))::int),
+		    locked_at=NULL
+		WHERE id=$1 RETURNING status`, id, message, maxRetry).Scan(&status)
+	if err != nil {
+		return classify(err)
+	}
+	if status == "failed" {
+		if _, err := tx.Exec(ctx, `UPDATE releases SET status='failed' WHERE id=$1`, releaseID); err != nil {
+			return err
+		}
+	}
+	return tx.Commit(ctx)
+}
+
+func (s *Store) OutboxStats(ctx context.Context) (domain.OutboxStats, error) {
+	var result domain.OutboxStats
+	err := s.pool.QueryRow(ctx, `
+		SELECT COUNT(*) FILTER (WHERE status='pending'),
+		       COUNT(*) FILTER (WHERE status='processing'),
+		       COUNT(*) FILTER (WHERE status='failed')
+		FROM release_outbox`).Scan(&result.Pending, &result.Processing, &result.Failed)
+	return result, err
+}
+
+type rowScanner interface {
+	Scan(...any) error
+}
+
+func scanConfig(row rowScanner) (domain.ConfigItem, error) {
+	var item domain.ConfigItem
+	err := row.Scan(&item.ID, &item.AppID, &item.NamespaceID, &item.EnvironmentID, &item.Key, &item.Value, &item.ReleasedValue, &item.PendingDelete, &item.Comment, &item.UpdatedBy, &item.UpdatedAt)
+	return item, err
+}
+
+func scanRelease(row rowScanner) (domain.Release, error) {
+	var item domain.Release
+	err := row.Scan(&item.ID, &item.AppID, &item.NamespaceID, &item.EnvironmentID, &item.Version, &item.Snapshot, &item.Added, &item.Modified, &item.Removed, &item.Comment, &item.Operator, &item.EtcdRevision, &item.Status, &item.Time)
+	return item, err
+}
+
+func scanGrayRule(row rowScanner) (domain.GrayRule, error) {
+	var item domain.GrayRule
+	err := row.Scan(&item.ID, &item.AppID, &item.NamespaceID, &item.EnvironmentID, &item.RuleType, &item.RuleValue, &item.Overrides, &item.Enabled, &item.Priority, &item.Desc, &item.CreatedAt)
+	return item, err
+}
+
+func listConfigTx(ctx context.Context, tx pgx.Tx, appID, namespaceID, envID int64, lock bool) ([]domain.ConfigItem, error) {
+	query := `
+		SELECT ci.id, n.app_id, ci.namespace_id, ci.env_id, ci.key, ci.value, ci.released_value,
+		       ci.pending_delete, ci.comment, ci.updated_by, ci.updated_at
+		FROM config_items ci JOIN namespaces n ON n.id=ci.namespace_id
+		WHERE n.app_id=$1 AND ci.namespace_id=$2 AND ci.env_id=$3 ORDER BY ci.key`
+	if lock {
+		query += ` FOR UPDATE OF ci`
+	}
+	rows, err := tx.Query(ctx, query, appID, namespaceID, envID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := make([]domain.ConfigItem, 0)
+	for rows.Next() {
+		item, err := scanConfig(rows)
+		if err != nil {
+			return nil, err
+		}
+		items = append(items, item)
+	}
+	return items, rows.Err()
+}
+
+func loadScope(ctx context.Context, tx pgx.Tx, appID, namespaceID, envID int64) (string, string, string, error) {
+	var appCode, namespaceName, envCode string
+	err := tx.QueryRow(ctx, `
+		SELECT a.app_code, n.name, e.env_code
+		FROM applications a JOIN namespaces n ON n.app_id=a.id CROSS JOIN environments e
+		WHERE a.id=$1 AND n.id=$2 AND e.id=$3`, appID, namespaceID, envID).Scan(&appCode, &namespaceName, &envCode)
+	return appCode, namespaceName, envCode, err
+}
+
+func nextVersion(ctx context.Context, tx pgx.Tx, namespaceID, envID int64) (int, error) {
+	var version int
+	err := tx.QueryRow(ctx, `SELECT COALESCE(MAX(version),0)+1 FROM releases WHERE namespace_id=$1 AND env_id=$2`, namespaceID, envID).Scan(&version)
+	return version, err
+}
+
+func insertRelease(ctx context.Context, tx pgx.Tx, appID, namespaceID, envID int64, version int, snapshot map[string]string, added, modified, removed int, comment, operator string) (domain.Release, error) {
+	item := domain.Release{AppID: appID, NamespaceID: namespaceID, EnvironmentID: envID, Version: version, Snapshot: snapshot, Added: added, Modified: modified, Removed: removed, Comment: comment, Operator: operator}
+	err := tx.QueryRow(ctx, `
+		INSERT INTO releases(namespace_id, env_id, version, snapshot, diff_added, diff_modified, diff_removed, comment, operator)
+		VALUES($1,$2,$3,$4,$5,$6,$7,$8,$9)
+		RETURNING id, status, created_at`, namespaceID, envID, version, snapshot, added, modified, removed, comment, operator,
+	).Scan(&item.ID, &item.Status, &item.Time)
+	return item, err
+}
+
+func (s *Store) deleteAndAudit(ctx context.Context, table, targetType string, id int64, updatedBy string) error {
+	if table != "applications" && table != "environments" && table != "namespaces" {
+		return errors.New("unsupported delete target")
+	}
+	tx, err := s.pool.Begin(ctx)
+	if err != nil {
+		return err
+	}
+	defer tx.Rollback(ctx)                                                             //nolint:errcheck
+	command, err := tx.Exec(ctx, fmt.Sprintf("DELETE FROM %s WHERE id=$1", table), id) // #nosec G201 -- table is allow-listed above.
+	if err != nil {
+		return classify(err)
+	}
+	if command.RowsAffected() == 0 {
+		return storepkg.ErrNotFound
+	}
+	if err := insertAudit(ctx, tx, actor(updatedBy), "delete", targetType, id, nil); err != nil {
+		return err
+	}
+	return tx.Commit(ctx)
+}
+
+func (s *Store) audit(ctx context.Context, updatedBy, action, targetType string, targetID int64, detail any) {
+	_, _ = s.pool.Exec(ctx, `INSERT INTO audit_logs(actor, action, target_type, target_id, detail) VALUES($1,$2,$3,$4,$5)`, actor(updatedBy), action, targetType, targetID, toJSON(detail))
+}
+
+func insertAudit(ctx context.Context, tx pgx.Tx, updatedBy, action, targetType string, targetID int64, detail any) error {
+	_, err := tx.Exec(ctx, `INSERT INTO audit_logs(actor, action, target_type, target_id, detail) VALUES($1,$2,$3,$4,$5)`, actor(updatedBy), action, targetType, targetID, toJSON(detail))
+	return err
+}
+
+func toJSON(value any) json.RawMessage {
+	payload, _ := json.Marshal(value)
+	return payload
+}
+
+func classify(err error) error {
+	if err == nil {
+		return nil
+	}
+	if errors.Is(err, pgx.ErrNoRows) {
+		return storepkg.ErrNotFound
+	}
+	var pgErr *pgconn.PgError
+	if errors.As(err, &pgErr) {
+		switch pgErr.Code {
+		case "23505":
+			return storepkg.ErrConflict
+		case "23503", "23514", "23502":
+			return fmt.Errorf("invalid data: %s", pgErr.Message)
+		}
+	}
+	return err
+}
+
+func actor(value string) string {
+	if strings.TrimSpace(value) == "" {
+		return "admin"
+	}
+	return strings.TrimSpace(value)
+}
+
+func advisoryKey(namespaceID, envID int64) int64 {
+	return namespaceID*1_000_000_000 + envID
+}
+
+func diff(current, target map[string]string) (added, modified, removed int) {
+	for key, value := range target {
+		old, exists := current[key]
+		if !exists {
+			added++
+		} else if old != value {
+			modified++
+		}
+	}
+	for key := range current {
+		if _, exists := target[key]; !exists {
+			removed++
+		}
+	}
+	return
+}
+
+var _ = time.Second
diff --git a/internal/store/store.go b/internal/store/store.go
new file mode 100644
index 0000000..0c443b2
--- /dev/null
+++ b/internal/store/store.go
@@ -0,0 +1,69 @@
+package store
+
+import (
+	"context"
+	"errors"
+
+	"github.com/longpeng/configcenter/internal/domain"
+)
+
+var (
+	ErrNotFound        = errors.New("resource not found")
+	ErrConflict        = errors.New("resource already exists")
+	ErrNoPendingChange = errors.New("no pending configuration changes")
+	ErrInvalidRollback = errors.New("invalid rollback target")
+)
+
+type Store interface {
+	Close()
+	Ping(context.Context) error
+
+	ListApplications(context.Context) ([]domain.Application, error)
+	CreateApplication(context.Context, domain.Application) (domain.Application, error)
+	UpdateApplication(context.Context, int64, domain.Application) (domain.Application, error)
+	DeleteApplication(context.Context, int64, string) error
+
+	ListEnvironments(context.Context) ([]domain.Environment, error)
+	CreateEnvironment(context.Context, domain.Environment) (domain.Environment, error)
+	UpdateEnvironment(context.Context, int64, domain.Environment) (domain.Environment, error)
+	DeleteEnvironment(context.Context, int64, string) error
+
+	ListNamespaces(context.Context, *int64) ([]domain.Namespace, error)
+	GetNamespace(context.Context, int64) (domain.Namespace, error)
+	CreateNamespace(context.Context, domain.Namespace) (domain.Namespace, error)
+	UpdateNamespace(context.Context, int64, domain.Namespace) (domain.Namespace, error)
+	DeleteNamespace(context.Context, int64, string) error
+
+	ListConfigItems(context.Context, int64, int64, int64) ([]domain.ConfigItem, error)
+	GetConfigItem(context.Context, int64) (domain.ConfigItem, error)
+	CreateConfigItem(context.Context, domain.ConfigItem) (domain.ConfigItem, error)
+	UpdateConfigItem(context.Context, int64, domain.ConfigItem) (domain.ConfigItem, error)
+	SetConfigItemPendingDelete(context.Context, int64, bool, string) (domain.ConfigItem, error)
+
+	Publish(context.Context, domain.PublishRequest) (domain.Release, error)
+	Rollback(context.Context, domain.RollbackRequest) (domain.Release, error)
+	ListReleases(context.Context, int64, int64, int64) ([]domain.Release, error)
+	GetRelease(context.Context, int64) (domain.Release, error)
+	ListAuditLogs(context.Context, int) ([]domain.AuditLog, error)
+
+	EnsureBootstrapAdmin(context.Context, string, string, string) error
+	FindUserByUsername(context.Context, string) (domain.UserCredential, error)
+	ListUsers(context.Context) ([]domain.User, error)
+	CreateUser(context.Context, domain.User, string) (domain.User, error)
+	SetUserAppRole(context.Context, domain.UserAppRole) error
+	DeleteUserAppRole(context.Context, int64, int64, string) error
+	GetUserAppRole(context.Context, int64, int64) (string, error)
+	ListUserAppRoles(context.Context, int64) ([]domain.UserAppRole, error)
+
+	ResolveScope(context.Context, string, string, string) (int64, int64, int64, error)
+	ListGrayRules(context.Context, int64, int64, int64) ([]domain.GrayRule, error)
+	GetGrayRule(context.Context, int64) (domain.GrayRule, error)
+	CreateGrayRule(context.Context, domain.GrayRule, string) (domain.GrayRule, error)
+	UpdateGrayRule(context.Context, int64, domain.GrayRule, string) (domain.GrayRule, error)
+	DeleteGrayRule(context.Context, int64, string) error
+
+	ClaimOutbox(context.Context, int) ([]domain.OutboxEntry, error)
+	MarkOutboxDone(context.Context, int64, int64, int64) error
+	MarkOutboxFailed(context.Context, int64, int64, string, int) error
+	OutboxStats(context.Context) (domain.OutboxStats, error)
+}
diff --git a/internal/watch/hub.go b/internal/watch/hub.go
new file mode 100644
index 0000000..323bae4
--- /dev/null
+++ b/internal/watch/hub.go
@@ -0,0 +1,82 @@
+package watch
+
+import (
+	"context"
+	"sync"
+
+	"github.com/longpeng/configcenter/internal/domain"
+	runtimepkg "github.com/longpeng/configcenter/internal/runtime"
+)
+
+type Hub struct {
+	ctx     context.Context
+	runtime runtimepkg.Store
+	mu      sync.Mutex
+	keys    map[string]*keyWatch
+}
+
+type keyWatch struct {
+	cancel context.CancelFunc
+	nextID int64
+	subs   map[int64]chan domain.ConfigEvent
+}
+
+func New(ctx context.Context, runtimeStore runtimepkg.Store) *Hub {
+	return &Hub{ctx: ctx, runtime: runtimeStore, keys: make(map[string]*keyWatch)}
+}
+
+func (h *Hub) Subscribe(key string) (<-chan domain.ConfigEvent, func()) {
+	h.mu.Lock()
+	watch, exists := h.keys[key]
+	if !exists {
+		ctx, cancel := context.WithCancel(h.ctx)
+		watch = &keyWatch{cancel: cancel, subs: make(map[int64]chan domain.ConfigEvent)}
+		h.keys[key] = watch
+		go h.run(ctx, key, watch)
+	}
+	watch.nextID++
+	id := watch.nextID
+	channel := make(chan domain.ConfigEvent, 16)
+	watch.subs[id] = channel
+	h.mu.Unlock()
+
+	var once sync.Once
+	return channel, func() {
+		once.Do(func() {
+			h.mu.Lock()
+			current, ok := h.keys[key]
+			if ok {
+				if ch, found := current.subs[id]; found {
+					delete(current.subs, id)
+					close(ch)
+				}
+				if len(current.subs) == 0 {
+					current.cancel()
+					delete(h.keys, key)
+				}
+			}
+			h.mu.Unlock()
+		})
+	}
+}
+
+func (h *Hub) run(ctx context.Context, key string, target *keyWatch) {
+	for result := range h.runtime.Watch(ctx, key, 0) {
+		if result.Err != nil {
+			return
+		}
+		h.mu.Lock()
+		current, exists := h.keys[key]
+		if !exists || current != target {
+			h.mu.Unlock()
+			return
+		}
+		for _, channel := range current.subs {
+			select {
+			case channel <- result.Event:
+			default:
+			}
+		}
+		h.mu.Unlock()
+	}
+}
diff --git a/pkg/sdk/go/client.go b/pkg/sdk/go/client.go
new file mode 100644
index 0000000..4811cdf
--- /dev/null
+++ b/pkg/sdk/go/client.go
@@ -0,0 +1,324 @@
+// Package configsdk provides a concurrency-safe Config Center client with
+// full-snapshot synchronization and an optional local-file fallback cache.
+package configsdk
+
+import (
+	"bufio"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+)
+
+type Options struct {
+	BaseURL    string
+	Env        string
+	App        string
+	Token      string
+	IP         string
+	Instance   string
+	CacheFile  string
+	HTTPClient *http.Client
+}
+
+type Client struct {
+	baseURL   string
+	env       string
+	app       string
+	token     string
+	ip        string
+	instance  string
+	cacheFile string
+	http      *http.Client
+
+	mu        sync.RWMutex
+	cache     map[string]map[string]string
+	revisions map[string]int64
+}
+
+type apiEnvelope struct {
+	Data json.RawMessage `json:"data"`
+}
+
+type runtimeConfig struct {
+	Items          map[string]string `json:"items"`
+	Revision       int64             `json:"revision"`
+	ReleaseVersion int               `json:"releaseVersion"`
+}
+
+type configEvent struct {
+	Type     string            `json:"type"`
+	Items    map[string]string `json:"items"`
+	Revision int64             `json:"revision"`
+}
+
+type diskCache struct {
+	Namespaces map[string]map[string]string `json:"namespaces"`
+	Revisions  map[string]int64             `json:"revisions"`
+}
+
+func New(options Options) (*Client, error) {
+	if strings.TrimSpace(options.BaseURL) == "" || strings.TrimSpace(options.Env) == "" || strings.TrimSpace(options.App) == "" {
+		return nil, errors.New("base URL, environment and application are required")
+	}
+	httpClient := options.HTTPClient
+	if httpClient == nil {
+		httpClient = &http.Client{Timeout: 15 * time.Second}
+	}
+	client := &Client{
+		baseURL:   strings.TrimRight(options.BaseURL, "/"),
+		env:       strings.TrimSpace(options.Env),
+		app:       strings.TrimSpace(options.App),
+		token:     strings.TrimSpace(options.Token),
+		ip:        strings.TrimSpace(options.IP),
+		instance:  strings.TrimSpace(options.Instance),
+		cacheFile: options.CacheFile,
+		http:      httpClient,
+		cache:     make(map[string]map[string]string),
+		revisions: make(map[string]int64),
+	}
+	if options.CacheFile != "" {
+		if err := client.loadDiskCache(); err != nil && !errors.Is(err, os.ErrNotExist) {
+			return nil, fmt.Errorf("load config cache: %w", err)
+		}
+	}
+	return client, nil
+}
+
+func (c *Client) GetString(namespace, key, fallback string) string {
+	c.mu.RLock()
+	defer c.mu.RUnlock()
+	if items, ok := c.cache[namespace]; ok {
+		if value, exists := items[key]; exists {
+			return value
+		}
+	}
+	return fallback
+}
+
+func (c *Client) GetInt(namespace, key string, fallback int) int {
+	value := c.GetString(namespace, key, "")
+	parsed, err := strconv.Atoi(value)
+	if err != nil {
+		return fallback
+	}
+	return parsed
+}
+
+func (c *Client) GetBool(namespace, key string, fallback bool) bool {
+	value := c.GetString(namespace, key, "")
+	parsed, err := strconv.ParseBool(value)
+	if err != nil {
+		return fallback
+	}
+	return parsed
+}
+
+func (c *Client) Snapshot(namespace string) map[string]string {
+	c.mu.RLock()
+	defer c.mu.RUnlock()
+	return clone(c.cache[namespace])
+}
+
+func (c *Client) Load(ctx context.Context, namespace string) error {
+	endpoint := c.endpoint("/v1/config", namespace)
+	request, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil)
+	if err != nil {
+		return err
+	}
+	c.authorize(request)
+	response, err := c.http.Do(request)
+	if err != nil {
+		return err
+	}
+	defer response.Body.Close()
+	if response.StatusCode != http.StatusOK {
+		return responseError(response)
+	}
+	var envelope apiEnvelope
+	if err := json.NewDecoder(response.Body).Decode(&envelope); err != nil {
+		return err
+	}
+	var current runtimeConfig
+	if err := json.Unmarshal(envelope.Data, &current); err != nil {
+		return err
+	}
+	return c.apply(namespace, current.Items, current.Revision)
+}
+
+// WatchAndSync blocks until ctx is canceled. It reconnects with exponential
+// backoff and replaces the namespace cache only with complete snapshots.
+func (c *Client) WatchAndSync(ctx context.Context, namespace string) error {
+	backoff := time.Second
+	for {
+		err := c.watchOnce(ctx, namespace)
+		if ctx.Err() != nil {
+			return nil
+		}
+		if err == nil {
+			backoff = time.Second
+		}
+		timer := time.NewTimer(backoff)
+		select {
+		case <-ctx.Done():
+			timer.Stop()
+			return nil
+		case <-timer.C:
+		}
+		if backoff < 30*time.Second {
+			backoff *= 2
+		}
+	}
+}
+
+func (c *Client) watchOnce(ctx context.Context, namespace string) error {
+	request, err := http.NewRequestWithContext(ctx, http.MethodGet, c.endpoint("/v1/watch", namespace), nil)
+	if err != nil {
+		return err
+	}
+	request.Header.Set("Accept", "text/event-stream")
+	c.authorize(request)
+	response, err := c.http.Do(request)
+	if err != nil {
+		return err
+	}
+	defer response.Body.Close()
+	if response.StatusCode != http.StatusOK {
+		return responseError(response)
+	}
+	scanner := bufio.NewScanner(response.Body)
+	scanner.Buffer(make([]byte, 64*1024), 10*1024*1024)
+	var data strings.Builder
+	for scanner.Scan() {
+		line := scanner.Text()
+		if line == "" {
+			if data.Len() > 0 {
+				var event configEvent
+				if err := json.Unmarshal([]byte(data.String()), &event); err != nil {
+					return err
+				}
+				if err := c.apply(namespace, event.Items, event.Revision); err != nil {
+					return err
+				}
+				data.Reset()
+			}
+			continue
+		}
+		if strings.HasPrefix(line, "data:") {
+			if data.Len() > 0 {
+				data.WriteByte('\n')
+			}
+			data.WriteString(strings.TrimSpace(strings.TrimPrefix(line, "data:")))
+		}
+	}
+	if err := scanner.Err(); err != nil {
+		return err
+	}
+	return io.EOF
+}
+
+func (c *Client) endpoint(path, namespace string) string {
+	query := url.Values{"env": {c.env}, "app": {c.app}, "namespace": {namespace}}
+	if c.ip != "" {
+		query.Set("ip", c.ip)
+	}
+	if c.instance != "" {
+		query.Set("instance", c.instance)
+	}
+	return c.baseURL + path + "?" + query.Encode()
+}
+
+func (c *Client) authorize(request *http.Request) {
+	if c.token != "" {
+		request.Header.Set("Authorization", "Bearer "+c.token)
+	}
+}
+
+func (c *Client) apply(namespace string, items map[string]string, revision int64) error {
+	c.mu.Lock()
+	if revision > 0 && revision < c.revisions[namespace] {
+		c.mu.Unlock()
+		return nil
+	}
+	c.cache[namespace] = clone(items)
+	c.revisions[namespace] = revision
+	err := c.saveDiskCacheLocked()
+	c.mu.Unlock()
+	return err
+}
+
+func (c *Client) loadDiskCache() error {
+	payload, err := os.ReadFile(c.cacheFile)
+	if err != nil {
+		return err
+	}
+	var cached diskCache
+	if err := json.Unmarshal(payload, &cached); err != nil {
+		return err
+	}
+	if cached.Namespaces != nil {
+		c.cache = cached.Namespaces
+	}
+	if cached.Revisions != nil {
+		c.revisions = cached.Revisions
+	}
+	return nil
+}
+
+func (c *Client) saveDiskCacheLocked() error {
+	if c.cacheFile == "" {
+		return nil
+	}
+	payload, err := json.MarshalIndent(diskCache{Namespaces: c.cache, Revisions: c.revisions}, "", "  ")
+	if err != nil {
+		return err
+	}
+	directory := filepath.Dir(c.cacheFile)
+	if err := os.MkdirAll(directory, 0o700); err != nil {
+		return err
+	}
+	temporary, err := os.CreateTemp(directory, ".configcenter-cache-*")
+	if err != nil {
+		return err
+	}
+	temporaryName := temporary.Name()
+	defer os.Remove(temporaryName) //nolint:errcheck
+	if err := temporary.Chmod(0o600); err != nil {
+		temporary.Close()
+		return err
+	}
+	if _, err := temporary.Write(payload); err != nil {
+		temporary.Close()
+		return err
+	}
+	if err := temporary.Sync(); err != nil {
+		temporary.Close()
+		return err
+	}
+	if err := temporary.Close(); err != nil {
+		return err
+	}
+	return os.Rename(temporaryName, c.cacheFile)
+}
+
+func responseError(response *http.Response) error {
+	payload, _ := io.ReadAll(io.LimitReader(response.Body, 64*1024))
+	return fmt.Errorf("config center returned %s: %s", response.Status, strings.TrimSpace(string(payload)))
+}
+
+func clone(input map[string]string) map[string]string {
+	result := make(map[string]string, len(input))
+	for key, value := range input {
+		result[key] = value
+	}
+	return result
+}
diff --git a/pkg/sdk/go/client_test.go b/pkg/sdk/go/client_test.go
new file mode 100644
index 0000000..9ad7297
--- /dev/null
+++ b/pkg/sdk/go/client_test.go
@@ -0,0 +1,42 @@
+package configsdk
+
+import (
+	"context"
+	"io"
+	"net/http"
+	"strings"
+	"testing"
+)
+
+type roundTripFunc func(*http.Request) (*http.Response, error)
+
+func (fn roundTripFunc) RoundTrip(request *http.Request) (*http.Response, error) { return fn(request) }
+
+func TestLoadSendsAuthenticationAndGrayTarget(t *testing.T) {
+	transport := roundTripFunc(func(r *http.Request) (*http.Response, error) {
+		if got := r.Header.Get("Authorization"); got != "Bearer sdk-token" {
+			t.Errorf("unexpected authorization header %q", got)
+		}
+		query := r.URL.Query()
+		if query.Get("env") != "PROD" || query.Get("app") != "orders" || query.Get("namespace") != "application" || query.Get("ip") != "10.0.0.8" || query.Get("instance") != "orders-3" {
+			t.Errorf("unexpected query: %s", r.URL.RawQuery)
+		}
+		return &http.Response{
+			StatusCode: http.StatusOK,
+			Header:     http.Header{"Content-Type": []string{"application/json"}},
+			Body:       io.NopCloser(strings.NewReader(`{"data":{"items":{"feature.gray":"on"},"revision":12,"releaseVersion":3,"grayRuleIds":[7]}}`)),
+			Request:    r,
+		}, nil
+	})
+
+	client, err := New(Options{BaseURL: "https://config.test", Env: "PROD", App: "orders", Token: "sdk-token", IP: "10.0.0.8", Instance: "orders-3", HTTPClient: &http.Client{Transport: transport}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := client.Load(context.Background(), "application"); err != nil {
+		t.Fatal(err)
+	}
+	if value := client.GetString("application", "feature.gray", "off"); value != "on" {
+		t.Fatalf("unexpected synchronized value %q", value)
+	}
+}
diff --git a/scripts/integration-smoke.sh b/scripts/integration-smoke.sh
new file mode 100644
index 0000000..19f147e
--- /dev/null
+++ b/scripts/integration-smoke.sh
@@ -0,0 +1,106 @@
+#!/usr/bin/env sh
+set -eu
+
+api_base="${CONFIGCENTER_API_BASE:-http://127.0.0.1:8080}"
+app_code="config-smoke-$(date +%s)-$$"
+app_id=""
+
+json_data_field() {
+    field="$1"
+    python3 -c 'import json,sys; payload=json.load(sys.stdin)["data"]; print(payload[sys.argv[1]])' "$field"
+}
+
+cleanup() {
+    if [ -n "$app_id" ]; then
+        curl -fsS -X DELETE -H 'X-User: integration-smoke' "$api_base/v1/applications/$app_id" >/dev/null || true
+    fi
+}
+trap cleanup EXIT INT TERM
+
+curl -fsS "$api_base/health/ready" >/dev/null
+
+app_response="$(curl -fsS -X POST \
+    -H 'Content-Type: application/json' \
+    -H 'X-User: integration-smoke' \
+    -d "{\"code\":\"$app_code\",\"name\":\"Integration Smoke\"}" \
+    "$api_base/v1/applications")"
+app_id="$(printf '%s' "$app_response" | json_data_field id)"
+
+env_id="$(curl -fsS "$api_base/v1/environments" | python3 -c '
+import json,sys
+for item in json.load(sys.stdin)["data"]:
+    if item["code"] == "DEV":
+        print(item["id"])
+        break
+else:
+    raise SystemExit("DEV environment not found")
+')"
+
+namespace_response="$(curl -fsS -X POST \
+    -H 'Content-Type: application/json' \
+    -H 'X-User: integration-smoke' \
+    -d "{\"appId\":$app_id,\"name\":\"application\",\"type\":\"properties\"}" \
+    "$api_base/v1/namespaces")"
+namespace_id="$(printf '%s' "$namespace_response" | json_data_field id)"
+
+curl -fsS -X POST \
+    -H 'Content-Type: application/json' \
+    -H 'X-User: integration-smoke' \
+    -d "{\"appId\":$app_id,\"nsId\":$namespace_id,\"envId\":$env_id,\"key\":\"smoke.enabled\",\"value\":\"true\"}" \
+    "$api_base/v1/config-items" >/dev/null
+
+release_response="$(curl -fsS -X POST \
+    -H 'Content-Type: application/json' \
+    -H 'X-User: integration-smoke' \
+    -d "{\"appId\":$app_id,\"nsId\":$namespace_id,\"envId\":$env_id,\"comment\":\"integration smoke\"}" \
+    "$api_base/v1/publish")"
+release_id="$(printf '%s' "$release_response" | json_data_field id)"
+
+attempt=0
+status="pending"
+while [ "$attempt" -lt 50 ]; do
+    release_response="$(curl -fsS "$api_base/v1/releases/$release_id")"
+    status="$(printf '%s' "$release_response" | json_data_field status)"
+    if [ "$status" = "applied" ]; then
+        break
+    fi
+    if [ "$status" = "failed" ]; then
+        printf 'release failed: %s\n' "$release_response" >&2
+        exit 1
+    fi
+    attempt=$((attempt + 1))
+    sleep 0.2
+done
+
+if [ "$status" != "applied" ]; then
+    printf 'release did not become applied (last status: %s)\n' "$status" >&2
+    exit 1
+fi
+
+runtime_response="$(curl -fsS "$api_base/v1/config?env=DEV&app=$app_code&namespace=application")"
+printf '%s' "$runtime_response" | python3 -c '
+import json,sys
+data=json.load(sys.stdin)["data"]
+assert data["items"]["smoke.enabled"] == "true", data
+assert data["releaseVersion"] == 1, data
+assert data["revision"] > 0, data
+'
+
+gray_response="$(curl -fsS -X POST \
+    -H 'Content-Type: application/json' \
+    -H 'X-User: integration-smoke' \
+    -d "{\"appId\":$app_id,\"nsId\":$namespace_id,\"envId\":$env_id,\"ruleType\":\"instance\",\"ruleValue\":{\"instances\":[\"smoke-1\"]},\"overrides\":{\"smoke.enabled\":\"gray\"},\"enabled\":true,\"priority\":10,\"desc\":\"smoke rule\"}" \
+    "$api_base/v1/gray-rules")"
+gray_id="$(printf '%s' "$gray_response" | json_data_field id)"
+
+gray_runtime_response="$(curl -fsS "$api_base/v1/config?env=DEV&app=$app_code&namespace=application&instance=smoke-1")"
+printf '%s' "$gray_runtime_response" | python3 -c '
+import json,sys
+data=json.load(sys.stdin)["data"]
+assert data["items"]["smoke.enabled"] == "gray", data
+assert len(data["grayRuleIds"]) == 1, data
+'
+
+curl -fsS "$api_base/metrics" | grep -q '^configcenter_gray_rule_matches_total 1$'
+
+printf 'integration smoke passed: release=%s gray_rule=%s status=%s\n' "$release_id" "$gray_id" "$status"
diff --git a/sdk/python/configcenter/__init__.py b/sdk/python/configcenter/__init__.py
new file mode 100644
index 0000000..d108369
--- /dev/null
+++ b/sdk/python/configcenter/__init__.py
@@ -0,0 +1,3 @@
+from .client import ConfigClient
+
+__all__ = ["ConfigClient"]
diff --git a/sdk/python/configcenter/client.py b/sdk/python/configcenter/client.py
new file mode 100644
index 0000000..bb331b4
--- /dev/null
+++ b/sdk/python/configcenter/client.py
@@ -0,0 +1,129 @@
+"""Thread-safe Config Center client using only Python's standard library."""
+
+from __future__ import annotations
+
+import json
+import os
+import tempfile
+import threading
+import time
+import urllib.parse
+import urllib.request
+from pathlib import Path
+from typing import Any
+
+
+class ConfigClient:
+    def __init__(
+        self,
+        base_url: str,
+        env: str,
+        app: str,
+        cache_file: str | None = None,
+        *,
+        token: str | None = None,
+        ip: str | None = None,
+        instance: str | None = None,
+    ):
+        if not base_url or not env or not app:
+            raise ValueError("base_url, env and app are required")
+        self._base_url = base_url.rstrip("/")
+        self._env = env
+        self._app = app
+        self._token = token or ""
+        self._ip = ip or ""
+        self._instance = instance or ""
+        self._cache_file = Path(cache_file) if cache_file else None
+        self._cache: dict[str, dict[str, str]] = {}
+        self._revisions: dict[str, int] = {}
+        self._lock = threading.RLock()
+        self._load_disk_cache()
+
+    def get(self, namespace: str, key: str, default: Any = None) -> Any:
+        with self._lock:
+            return self._cache.get(namespace, {}).get(key, default)
+
+    def snapshot(self, namespace: str) -> dict[str, str]:
+        with self._lock:
+            return dict(self._cache.get(namespace, {}))
+
+    def load(self, namespace: str, timeout: float = 10.0) -> None:
+        with urllib.request.urlopen(self._request("/v1/config", namespace), timeout=timeout) as response:
+            payload = json.load(response)["data"]
+        self._apply(namespace, payload.get("items", {}), int(payload.get("revision", 0)))
+
+    def start_background_watch(self, namespace: str) -> threading.Thread:
+        thread = threading.Thread(target=self.watch_and_sync, args=(namespace,), daemon=True)
+        thread.start()
+        return thread
+
+    def watch_and_sync(self, namespace: str) -> None:
+        backoff = 1.0
+        while True:
+            try:
+                request = self._request("/v1/watch", namespace, {"Accept": "text/event-stream"})
+                with urllib.request.urlopen(request, timeout=None) as response:
+                    backoff = 1.0
+                    data_lines: list[str] = []
+                    for raw_line in response:
+                        line = raw_line.decode("utf-8").rstrip("\r\n")
+                        if not line:
+                            if data_lines:
+                                event = json.loads("\n".join(data_lines))
+                                self._apply(namespace, event.get("items", {}), int(event.get("revision", 0)))
+                                data_lines.clear()
+                            continue
+                        if line.startswith("data:"):
+                            data_lines.append(line[5:].strip())
+            except Exception:
+                time.sleep(backoff)
+                backoff = min(backoff * 2, 30.0)
+
+    def _url(self, path: str, namespace: str) -> str:
+        values = {"env": self._env, "app": self._app, "namespace": namespace}
+        if self._ip:
+            values["ip"] = self._ip
+        if self._instance:
+            values["instance"] = self._instance
+        query = urllib.parse.urlencode(values)
+        return f"{self._base_url}{path}?{query}"
+
+    def _request(
+        self, path: str, namespace: str, headers: dict[str, str] | None = None
+    ) -> urllib.request.Request:
+        request_headers = dict(headers or {})
+        if self._token:
+            request_headers["Authorization"] = f"Bearer {self._token}"
+        return urllib.request.Request(self._url(path, namespace), headers=request_headers)
+
+    def _apply(self, namespace: str, items: dict[str, str], revision: int) -> None:
+        with self._lock:
+            if revision and revision < self._revisions.get(namespace, 0):
+                return
+            self._cache[namespace] = dict(items)
+            self._revisions[namespace] = revision
+            self._save_disk_cache()
+
+    def _load_disk_cache(self) -> None:
+        if not self._cache_file or not self._cache_file.exists():
+            return
+        payload = json.loads(self._cache_file.read_text(encoding="utf-8"))
+        self._cache = payload.get("namespaces", {})
+        self._revisions = payload.get("revisions", {})
+
+    def _save_disk_cache(self) -> None:
+        if not self._cache_file:
+            return
+        self._cache_file.parent.mkdir(parents=True, exist_ok=True, mode=0o700)
+        payload = {"namespaces": self._cache, "revisions": self._revisions}
+        descriptor, temporary = tempfile.mkstemp(prefix=".configcenter-cache-", dir=self._cache_file.parent)
+        try:
+            with os.fdopen(descriptor, "w", encoding="utf-8") as handle:
+                json.dump(payload, handle, ensure_ascii=False, indent=2)
+                handle.flush()
+                os.fsync(handle.fileno())
+            os.chmod(temporary, 0o600)
+            os.replace(temporary, self._cache_file)
+        finally:
+            if os.path.exists(temporary):
+                os.unlink(temporary)
diff --git a/sdk/python/pyproject.toml b/sdk/python/pyproject.toml
new file mode 100644
index 0000000..25db306
--- /dev/null
+++ b/sdk/python/pyproject.toml
@@ -0,0 +1,13 @@
+[build-system]
+requires = ["setuptools>=68"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "configcenter-client"
+version = "0.1.0"
+description = "Config Center Python client with SSE watch and local cache fallback"
+requires-python = ">=3.10"
+
+[tool.setuptools.packages.find]
+where = ["."]
+include = ["configcenter*"]
diff --git a/web/Dockerfile b/web/Dockerfile
new file mode 100644
index 0000000..4e5f74f
--- /dev/null
+++ b/web/Dockerfile
@@ -0,0 +1,12 @@
+FROM node:24-alpine AS build
+WORKDIR /src
+COPY web/package.json web/package-lock.json ./web/
+RUN cd web && npm ci
+COPY ConfigCenter.jsx ./ConfigCenter.jsx
+COPY web ./web
+RUN cd web && npm run build
+
+FROM nginx:1.27-alpine
+COPY web/nginx.conf /etc/nginx/conf.d/default.conf
+COPY --from=build /src/web/dist /usr/share/nginx/html
+EXPOSE 80
diff --git a/web/index.html b/web/index.html
new file mode 100644
index 0000000..9f8637f
--- /dev/null
+++ b/web/index.html
@@ -0,0 +1,13 @@
+<!doctype html>
+<html lang="zh-CN">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <meta name="theme-color" content="#0f172a" />
+    <title>Config Center</title>
+  </head>
+  <body>
+    <div id="root"></div>
+    <script type="module" src="/src/main.jsx"></script>
+  </body>
+</html>
diff --git a/web/nginx.conf b/web/nginx.conf
new file mode 100644
index 0000000..43b1492
--- /dev/null
+++ b/web/nginx.conf
@@ -0,0 +1,24 @@
+server {
+    listen 80;
+    server_name _;
+    root /usr/share/nginx/html;
+    index index.html;
+
+    location /v1/ {
+        proxy_pass http://server:8080;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_buffering off;
+        proxy_read_timeout 1h;
+    }
+
+    location /health/ {
+        proxy_pass http://server:8080;
+    }
+
+    location / {
+        try_files $uri $uri/ /index.html;
+    }
+}
diff --git a/web/package-lock.json b/web/package-lock.json
new file mode 100644
index 0000000..843bf46
--- /dev/null
+++ b/web/package-lock.json
@@ -0,0 +1,1848 @@
+{
+  "name": "configcenter-web",
+  "version": "0.1.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "configcenter-web",
+      "version": "0.1.0",
+      "dependencies": {
+        "@vitejs/plugin-react": "latest",
+        "autoprefixer": "latest",
+        "lucide-react": "latest",
+        "postcss": "latest",
+        "react": "latest",
+        "react-dom": "latest",
+        "tailwindcss": "^3.4.17",
+        "vite": "latest"
+      },
+      "devDependencies": {}
+    },
+    "node_modules/@alloc/quick-lru": {
+      "version": "5.2.0",
+      "resolved": "https://registry.npmjs.org/@alloc/quick-lru/-/quick-lru-5.2.0.tgz",
+      "integrity": "sha512-UrcABB+4bUrFABwbluTIBErXwvbsU/V7TZWfmbgJfbkwiBuziS9gxdODUyuiecfdGQ85jglMW6juS3+z5TsKLw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/@jridgewell/gen-mapping": {
+      "version": "0.3.13",
+      "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.13.tgz",
+      "integrity": "sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA==",
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/sourcemap-codec": "^1.5.0",
+        "@jridgewell/trace-mapping": "^0.3.24"
+      }
+    },
+    "node_modules/@jridgewell/resolve-uri": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.2.tgz",
+      "integrity": "sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
+    "node_modules/@jridgewell/sourcemap-codec": {
+      "version": "1.6.0",
+      "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.6.0.tgz",
+      "integrity": "sha512-T7jf+5zgsZHwNJ4lvQ7/aezbyk0nNX+zJVWpmHA7VYsEx7a7qr5Rg5IbtJFqkgze5Y2sruq1RUY8Q837Od7iFw==",
+      "license": "MIT"
+    },
+    "node_modules/@jridgewell/trace-mapping": {
+      "version": "0.3.31",
+      "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.31.tgz",
+      "integrity": "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==",
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/resolve-uri": "^3.1.0",
+        "@jridgewell/sourcemap-codec": "^1.4.14"
+      }
+    },
+    "node_modules/@nodelib/fs.scandir": {
+      "version": "2.1.5",
+      "resolved": "https://registry.npmjs.org/@nodelib/fs.scandir/-/fs.scandir-2.1.5.tgz",
+      "integrity": "sha512-vq24Bq3ym5HEQm2NKCr3yXDwjc7vTsEThRDnkp2DK9p1uqLR+DHurm/NOTo0KG7HYHU7eppKZj3MyqYuMBf62g==",
+      "license": "MIT",
+      "dependencies": {
+        "@nodelib/fs.stat": "2.0.5",
+        "run-parallel": "^1.1.9"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/@nodelib/fs.stat": {
+      "version": "2.0.5",
+      "resolved": "https://registry.npmjs.org/@nodelib/fs.stat/-/fs.stat-2.0.5.tgz",
+      "integrity": "sha512-RkhPPp2zrqDAQA/2jNhnztcPAlv64XdhIp7a7454A5ovI7Bukxgt7MX7udwAu3zg1DcpPU0rz3VV1SeaqvY4+A==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/@nodelib/fs.walk": {
+      "version": "1.2.8",
+      "resolved": "https://registry.npmjs.org/@nodelib/fs.walk/-/fs.walk-1.2.8.tgz",
+      "integrity": "sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg==",
+      "license": "MIT",
+      "dependencies": {
+        "@nodelib/fs.scandir": "2.1.5",
+        "fastq": "^1.6.0"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/@oxc-project/types": {
+      "version": "0.147.0",
+      "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.147.0.tgz",
+      "integrity": "sha512-IJ3s6ltHLp45S0bh7phkX+gJO7A1Wuz2EaqpAhb8WjqDwbzMiWKHhyyT42tskaWjEYXtHtVCPpnBJVT9+dcRLg==",
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/Boshen"
+      }
+    },
+    "node_modules/@rolldown/binding-android-arm-eabi": {
+      "version": "1.2.6",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm-eabi/-/binding-android-arm-eabi-1.2.6.tgz",
+      "integrity": "sha512-b+jTcARdTiFLI6jB4a5XjTm0RWd6KcRfQj/I2356fxUZemiho9zQLxo0RtCuMDAyKcLo6cEltkgbQp6d1+sjjQ==",
+      "cpu": [
+        "arm"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-android-arm64": {
+      "version": "1.2.6",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.2.6.tgz",
+      "integrity": "sha512-lkWU8ZJaRk9q3CIEY1Tc7vIFALp3Xw5NfGJo2hQg5oIqNgxWi1zI+IiDEK3r70BF5Dzol1tcXsnzsRc8NLhG+Q==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-darwin-arm64": {
+      "version": "1.2.6",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.2.6.tgz",
+      "integrity": "sha512-dgR56NYnvAszm7Ob1B2/Vn0e8bUQYZH2UjVaMMtMVOCKFSfjhfLmuA/9+O+F+ajUdG6B/bSssrKW6JJYASa8jA==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-darwin-x64": {
+      "version": "1.2.6",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.2.6.tgz",
+      "integrity": "sha512-vpVxFvUCFioJqug7OTvqptkc4yb8UX0AwfDmJpaR/0sWz+BUmqSVAf7c8JkUgnN8YLspb4a/N6NhTyMAmdyQ7Q==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-freebsd-x64": {
+      "version": "1.2.6",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.2.6.tgz",
+      "integrity": "sha512-h1wG6Y6K3JlRswxsI64qQJqBAy4vrLuHgRbc8CZMGSWTOFRY6ghMApM1NKzB2I0n5xV1fjkE18SuVl2QpLeNpA==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-linux-arm-gnueabihf": {
+      "version": "1.2.6",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.2.6.tgz",
+      "integrity": "sha512-tbCiqub0q2MVWJKgF5PoAlNWCtQydiOYSLIkd8sByqK/6MMYLJRcSXSYodqYtd0O+Fw7QaVmKKlS4oL94YRZ0w==",
+      "cpu": [
+        "arm"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-linux-arm64-gnu": {
+      "version": "1.2.6",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.2.6.tgz",
+      "integrity": "sha512-oxK9+baEBPhZG5HB4URY+uU04zJWeZlH6Tb9rB5DK4DF9XR1uXNLXt5Q5ZsugTKayNCNLhkcwz/ye74hRI98dg==",
+      "cpu": [
+        "arm64"
+      ],
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-linux-arm64-musl": {
+      "version": "1.2.6",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.2.6.tgz",
+      "integrity": "sha512-muWCk27FVBEZtv0MsK8gnfSmgczA8KQ0uRVJbTABKhkRfQc38aUrcb7fhi3BNiyseFmgcRsoMfQsSNJ+DbZdSw==",
+      "cpu": [
+        "arm64"
+      ],
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-linux-ppc64-gnu": {
+      "version": "1.2.6",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.2.6.tgz",
+      "integrity": "sha512-eWDoSfU7Co2qj3vgB3Dt4lj1mG6CoWbcJQkRMP3XJplyCMtuaq3LHvPFjS9QIPvMGWVadJC04Xiy0IdcVPtnwQ==",
+      "cpu": [
+        "ppc64"
+      ],
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-linux-s390x-gnu": {
+      "version": "1.2.6",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.2.6.tgz",
+      "integrity": "sha512-2bWNjRSIayvupRKxXUY2tWG9fYdoUlTqWywHRvE8Eq3GvuQ+f2HeIkve697fIt+IQs/PV8yFsdWuhp1aJ1PdnA==",
+      "cpu": [
+        "s390x"
+      ],
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-linux-x64-gnu": {
+      "version": "1.2.6",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.2.6.tgz",
+      "integrity": "sha512-KekI0gS0wLxe1UBSQSjenBVwou/JkcQPDzBPICGZjxUv9k3RteHDPBQaiOicZUFKRIH2wKEimGwVpnJsbPzu7w==",
+      "cpu": [
+        "x64"
+      ],
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-linux-x64-musl": {
+      "version": "1.2.6",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.2.6.tgz",
+      "integrity": "sha512-TvtPnfVr+HtyGiDmPK4VWmlNm7QhNNAcK5Q9A7aOXsI8545yCyaoMaicXrFZ72JzeYjaUVk7yT243zT0jzjFKQ==",
+      "cpu": [
+        "x64"
+      ],
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-openharmony-arm64": {
+      "version": "1.2.6",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.2.6.tgz",
+      "integrity": "sha512-iOo0VEay2XFhaCcH0sps5XIimkSuOnNaZrf6+ZkoSOQBJPKNU48RkmJv0/lSpipexu5P+ouFgafe5IGr/DiQfg==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openharmony"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-win32-arm64-msvc": {
+      "version": "1.2.6",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.2.6.tgz",
+      "integrity": "sha512-y5NTmmasMS455JlOCO4ZM9krIchv3Mvm1crL1iUPGOPgEzSkves9n0SdC5Sjz6+qWDFhd8/JpfWMH8NSWNHe+A==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-win32-x64-msvc": {
+      "version": "1.2.6",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.2.6.tgz",
+      "integrity": "sha512-np8iZSLfXlAD4kWhiyq/u0Yt8oZDtRQ8lGhQaCXo2rl37KNjeU0GjJuwr4P3oeZ++ROfofsKNBqR5LTO8aXyWQ==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/pluginutils": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/@rolldown/pluginutils/-/pluginutils-1.0.1.tgz",
+      "integrity": "sha512-2j9bGt5Jh8hj+vPtgzPtl72j0yRxHAyumoo6TNfAjsLB04UtpSvPbPcDcBMxz7n+9CYB0c1GxQFxYRg2jimqGw==",
+      "license": "MIT"
+    },
+    "node_modules/@vitejs/plugin-react": {
+      "version": "6.1.1",
+      "resolved": "https://registry.npmjs.org/@vitejs/plugin-react/-/plugin-react-6.1.1.tgz",
+      "integrity": "sha512-yxLaQV9gkhS8ezJqCM6+ndU7mDY6gqAg75NQ+0IjwEI8IYOmQCgkRwHKVSfWXW076DsqMo0Dk+0FK1U+M5RgFw==",
+      "license": "MIT",
+      "dependencies": {
+        "@rolldown/pluginutils": "^1.0.1"
+      },
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      },
+      "peerDependencies": {
+        "@rolldown/plugin-babel": "^0.1.7 || ^0.2.0",
+        "babel-plugin-react-compiler": "^1.0.0",
+        "oxc-transform-react": "^0.145.0",
+        "vite": "^8.0.0"
+      },
+      "peerDependenciesMeta": {
+        "@rolldown/plugin-babel": {
+          "optional": true
+        },
+        "babel-plugin-react-compiler": {
+          "optional": true
+        },
+        "oxc-transform-react": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/any-promise": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/any-promise/-/any-promise-1.3.0.tgz",
+      "integrity": "sha512-7UvmKalWRt1wgjL1RrGxoSJW/0QZFIegpeGvZG9kjp8vrRu55XTHbwnqq2GpXm9uLbcuhxm3IqX9OB4MZR1b2A==",
+      "license": "MIT"
+    },
+    "node_modules/anymatch": {
+      "version": "3.1.3",
+      "resolved": "https://registry.npmjs.org/anymatch/-/anymatch-3.1.3.tgz",
+      "integrity": "sha512-KMReFUr0B4t+D+OBkjR3KYqvocp2XaSzO55UcB6mgQMd3KbcE+mWTyvVV7D/zsdEbNnV6acZUutkiHQXvTr1Rw==",
+      "license": "ISC",
+      "dependencies": {
+        "normalize-path": "^3.0.0",
+        "picomatch": "^2.0.4"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/arg": {
+      "version": "5.0.2",
+      "resolved": "https://registry.npmjs.org/arg/-/arg-5.0.2.tgz",
+      "integrity": "sha512-PYjyFOLKQ9y57JvQ6QLo8dAgNqswh8M1RMJYdQduT6xbWSgK36P/Z/v+p888pM69jMMfS8Xd8F6I1kQ/I9HUGg==",
+      "license": "MIT"
+    },
+    "node_modules/autoprefixer": {
+      "version": "10.5.4",
+      "resolved": "https://registry.npmjs.org/autoprefixer/-/autoprefixer-10.5.4.tgz",
+      "integrity": "sha512-MaU0U/za7N3r6brxD4YB/l4NSrFzLPlANv6wEuQVaIPlD3L4W9rFcQPbL/EilY9BHhHvhfcz3gInDLrEtWT4EA==",
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/postcss/"
+        },
+        {
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/autoprefixer"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "browserslist": "^4.28.6",
+        "caniuse-lite": "^1.0.30001806",
+        "fraction.js": "^5.3.4",
+        "picocolors": "^1.1.1",
+        "postcss-value-parser": "^4.2.0"
+      },
+      "bin": {
+        "autoprefixer": "bin/autoprefixer"
+      },
+      "engines": {
+        "node": "^10 || ^12 || >=14"
+      },
+      "peerDependencies": {
+        "postcss": "^8.1.0"
+      }
+    },
+    "node_modules/baseline-browser-mapping": {
+      "version": "2.11.20",
+      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.20.tgz",
+      "integrity": "sha512-H0ulySigv6icDJ1F7SjtdCD6PrhTpdYCmP0CactWy1+ekh0AFd0o1Wn5T8b+hnTmdBx19u9yhL6wvCylXMY7zw==",
+      "license": "Apache-2.0",
+      "bin": {
+        "baseline-browser-mapping": "dist/cli.cjs"
+      },
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
+    "node_modules/binary-extensions": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/binary-extensions/-/binary-extensions-2.3.0.tgz",
+      "integrity": "sha512-Ceh+7ox5qe7LJuLHoY0feh3pHuUDHAcRUeyL2VYghZwfpkNIy/+8Ocg0a3UuSoYzavmylwuLWQOf3hl0jjMMIw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/braces": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/braces/-/braces-3.0.3.tgz",
+      "integrity": "sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==",
+      "license": "MIT",
+      "dependencies": {
+        "fill-range": "^7.1.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/browserslist": {
+      "version": "4.28.8",
+      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.8.tgz",
+      "integrity": "sha512-V2NpofLblG64mfOtSgDhOJESZEGogzDMBv/q+W6oc4LXWP/q75eOXoOaaOu1EOadB9U4Bwx/e0yzbvwKH8zalA==",
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/browserslist"
+        },
+        {
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/browserslist"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "baseline-browser-mapping": "^2.11.12",
+        "caniuse-lite": "^1.0.30001809",
+        "electron-to-chromium": "^1.5.402",
+        "node-releases": "^2.0.53",
+        "update-browserslist-db": "^1.3.0"
+      },
+      "bin": {
+        "browserslist": "cli.js"
+      },
+      "engines": {
+        "node": "^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7"
+      }
+    },
+    "node_modules/camelcase-css": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/camelcase-css/-/camelcase-css-2.0.1.tgz",
+      "integrity": "sha512-QOSvevhslijgYwRx6Rv7zKdMF8lbRmx+uQGx2+vDc+KI/eBnsy9kit5aj23AgGu3pa4t9AgwbnXWqS+iOY+2aA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/caniuse-lite": {
+      "version": "1.0.30001810",
+      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001810.tgz",
+      "integrity": "sha512-TITQPUkaz+aVk5GL6NhOdwk1aEaNTSDPsGFWrTuhKGtjTF70jL/Oht2W4c6rXUe5fu7Ie19VIahAXHIIiWWNeg==",
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/browserslist"
+        },
+        {
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/caniuse-lite"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "CC-BY-4.0"
+    },
+    "node_modules/chokidar": {
+      "version": "3.6.0",
+      "resolved": "https://registry.npmjs.org/chokidar/-/chokidar-3.6.0.tgz",
+      "integrity": "sha512-7VT13fmjotKpGipCW9JEQAusEPE+Ei8nl6/g4FBAmIm0GOOLMua9NDDo/DWp0ZAxCr3cPq5ZpBqmPAQgDda2Pw==",
+      "license": "MIT",
+      "dependencies": {
+        "anymatch": "~3.1.2",
+        "braces": "~3.0.2",
+        "glob-parent": "~5.1.2",
+        "is-binary-path": "~2.1.0",
+        "is-glob": "~4.0.1",
+        "normalize-path": "~3.0.0",
+        "readdirp": "~3.6.0"
+      },
+      "engines": {
+        "node": ">= 8.10.0"
+      },
+      "funding": {
+        "url": "https://paulmillr.com/funding/"
+      },
+      "optionalDependencies": {
+        "fsevents": "~2.3.2"
+      }
+    },
+    "node_modules/chokidar/node_modules/glob-parent": {
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.2.tgz",
+      "integrity": "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==",
+      "license": "ISC",
+      "dependencies": {
+        "is-glob": "^4.0.1"
+      },
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/commander": {
+      "version": "4.1.1",
+      "resolved": "https://registry.npmjs.org/commander/-/commander-4.1.1.tgz",
+      "integrity": "sha512-NOKm8xhkzAjzFx8B2v5OAHT+u5pRQc2UCa2Vq9jYL/31o2wi9mxBA7LIFs3sV5VSC49z6pEhfbMULvShKj26WA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/cssesc": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/cssesc/-/cssesc-3.0.0.tgz",
+      "integrity": "sha512-/Tb/JcjK111nNScGob5MNtsntNM1aCNUDipB/TkwZFhyDrrE47SOx/18wF2bbjgc3ZzCSKW1T5nt5EbFoAz/Vg==",
+      "license": "MIT",
+      "bin": {
+        "cssesc": "bin/cssesc"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/detect-libc": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz",
+      "integrity": "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==",
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/didyoumean": {
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/didyoumean/-/didyoumean-1.2.2.tgz",
+      "integrity": "sha512-gxtyfqMg7GKyhQmb056K7M3xszy/myH8w+B4RT+QXBQsvAOdc3XymqDDPHx1BgPgsdAA5SIifona89YtRATDzw==",
+      "license": "Apache-2.0"
+    },
+    "node_modules/dlv": {
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/dlv/-/dlv-1.1.3.tgz",
+      "integrity": "sha512-+HlytyjlPKnIG8XuRG8WvmBP8xs8P71y+SKKS6ZXWoEgLuePxtDoUEiH7WkdePWrQ5JBpE6aoVqfZfJUQkjXwA==",
+      "license": "MIT"
+    },
+    "node_modules/electron-to-chromium": {
+      "version": "1.5.416",
+      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.416.tgz",
+      "integrity": "sha512-K6bvB2BjnNrugtIih6ewlbBI9DXa976jIdiIlRLHhBoEI9a4JaQjjHyF+A1IQI543aQYR4LnmOrT/K5fZj0aPA==",
+      "license": "ISC"
+    },
+    "node_modules/es-errors": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/es-errors/-/es-errors-1.3.0.tgz",
+      "integrity": "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/escalade": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/escalade/-/escalade-3.2.0.tgz",
+      "integrity": "sha512-WUj2qlxaQtO4g6Pq5c29GTcWGDyd8itL8zTlipgECz3JesAiiOKotd8JU6otB3PACgG6xkJUyVhboMS+bje/jA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/fast-glob": {
+      "version": "3.3.3",
+      "resolved": "https://registry.npmjs.org/fast-glob/-/fast-glob-3.3.3.tgz",
+      "integrity": "sha512-7MptL8U0cqcFdzIzwOTHoilX9x5BrNqye7Z/LuC7kCMRio1EMSyqRK3BEAUD7sXRq4iT4AzTVuZdhgQ2TCvYLg==",
+      "license": "MIT",
+      "dependencies": {
+        "@nodelib/fs.stat": "^2.0.2",
+        "@nodelib/fs.walk": "^1.2.3",
+        "glob-parent": "^5.1.2",
+        "merge2": "^1.3.0",
+        "micromatch": "^4.0.8"
+      },
+      "engines": {
+        "node": ">=8.6.0"
+      }
+    },
+    "node_modules/fast-glob/node_modules/glob-parent": {
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.2.tgz",
+      "integrity": "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==",
+      "license": "ISC",
+      "dependencies": {
+        "is-glob": "^4.0.1"
+      },
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/fastq": {
+      "version": "1.20.3",
+      "resolved": "https://registry.npmjs.org/fastq/-/fastq-1.20.3.tgz",
+      "integrity": "sha512-XKv5nnLs6nLF71NgiKJLIZFLkPyIEuOselLG7ujZnGrRfQK8HpvY+WqKhAJUAdLomwVHErVS4LfxFlPq0/FTAw==",
+      "license": "ISC",
+      "dependencies": {
+        "reusify": "^1.0.4"
+      }
+    },
+    "node_modules/fill-range": {
+      "version": "7.1.1",
+      "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.1.1.tgz",
+      "integrity": "sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg==",
+      "license": "MIT",
+      "dependencies": {
+        "to-regex-range": "^5.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/fraction.js": {
+      "version": "5.3.4",
+      "resolved": "https://registry.npmjs.org/fraction.js/-/fraction.js-5.3.4.tgz",
+      "integrity": "sha512-1X1NTtiJphryn/uLQz3whtY6jK3fTqoE3ohKs0tT+Ujr1W59oopxmoEh7Lu5p6vBaPbgoM0bzveAW4Qi5RyWDQ==",
+      "license": "MIT",
+      "engines": {
+        "node": "*"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/rawify"
+      }
+    },
+    "node_modules/fsevents": {
+      "version": "2.3.3",
+      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz",
+      "integrity": "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==",
+      "hasInstallScript": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
+      }
+    },
+    "node_modules/function-bind": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.2.tgz",
+      "integrity": "sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==",
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/glob-parent": {
+      "version": "6.0.2",
+      "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-6.0.2.tgz",
+      "integrity": "sha512-XxwI8EOhVQgWp6iDL+3b0r86f4d6AX6zSU55HfB4ydCEuXLXc5FcYeOu+nnGftS4TEju/11rt4KJPTMgbfmv4A==",
+      "license": "ISC",
+      "dependencies": {
+        "is-glob": "^4.0.3"
+      },
+      "engines": {
+        "node": ">=10.13.0"
+      }
+    },
+    "node_modules/hasown": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.4.tgz",
+      "integrity": "sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==",
+      "license": "MIT",
+      "dependencies": {
+        "function-bind": "^1.1.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/is-binary-path": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/is-binary-path/-/is-binary-path-2.1.0.tgz",
+      "integrity": "sha512-ZMERYes6pDydyuGidse7OsHxtbI7WVeUEozgR/g7rd0xUimYNlvZRE/K2MgZTjWy725IfelLeVcEM97mmtRGXw==",
+      "license": "MIT",
+      "dependencies": {
+        "binary-extensions": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/is-core-module": {
+      "version": "2.16.2",
+      "resolved": "https://registry.npmjs.org/is-core-module/-/is-core-module-2.16.2.tgz",
+      "integrity": "sha512-evOr8xfXKxE6qSR0hSXL2r3sd7ALj8+7jQEUvPYcm5sgZFdJ+AYzT6yNmJenvIYQBgIGwfwz08sL8zoL7yq2BA==",
+      "license": "MIT",
+      "dependencies": {
+        "hasown": "^2.0.3"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/is-extglob": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/is-extglob/-/is-extglob-2.1.1.tgz",
+      "integrity": "sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/is-glob": {
+      "version": "4.0.3",
+      "resolved": "https://registry.npmjs.org/is-glob/-/is-glob-4.0.3.tgz",
+      "integrity": "sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==",
+      "license": "MIT",
+      "dependencies": {
+        "is-extglob": "^2.1.1"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/is-number": {
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/is-number/-/is-number-7.0.0.tgz",
+      "integrity": "sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.12.0"
+      }
+    },
+    "node_modules/jiti": {
+      "version": "1.21.7",
+      "resolved": "https://registry.npmjs.org/jiti/-/jiti-1.21.7.tgz",
+      "integrity": "sha512-/imKNG4EbWNrVjoNC/1H5/9GFy+tqjGBHCaSsN+P2RnPqjsLmv6UD3Ej+Kj8nBWaRAwyk7kK5ZUc+OEatnTR3A==",
+      "license": "MIT",
+      "bin": {
+        "jiti": "bin/jiti.js"
+      }
+    },
+    "node_modules/lightningcss": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss/-/lightningcss-1.33.0.tgz",
+      "integrity": "sha512-WkUDrojuJs0xkgGf2udWxa3yGBRxPtxUkB79i6aCZLRgc7PM8fZe9TosfPDcvEpQZbuFASnHYmRLBLUbmLOIIA==",
+      "license": "MPL-2.0",
+      "dependencies": {
+        "detect-libc": "^2.0.3"
+      },
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      },
+      "optionalDependencies": {
+        "lightningcss-android-arm64": "1.33.0",
+        "lightningcss-darwin-arm64": "1.33.0",
+        "lightningcss-darwin-x64": "1.33.0",
+        "lightningcss-freebsd-x64": "1.33.0",
+        "lightningcss-linux-arm-gnueabihf": "1.33.0",
+        "lightningcss-linux-arm64-gnu": "1.33.0",
+        "lightningcss-linux-arm64-musl": "1.33.0",
+        "lightningcss-linux-x64-gnu": "1.33.0",
+        "lightningcss-linux-x64-musl": "1.33.0",
+        "lightningcss-win32-arm64-msvc": "1.33.0",
+        "lightningcss-win32-x64-msvc": "1.33.0"
+      }
+    },
+    "node_modules/lightningcss-android-arm64": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-android-arm64/-/lightningcss-android-arm64-1.33.0.tgz",
+      "integrity": "sha512-gEpRTalKdosp4Bb8qWtc2iOgE5SeIHlpS1up9bFq2wAyYhl1UdTObYiHe98zEM9SQvSoqQZ1IQD0JNpg3Ml5pg==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-darwin-arm64": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-darwin-arm64/-/lightningcss-darwin-arm64-1.33.0.tgz",
+      "integrity": "sha512-Sciaz8eenNTKn9b3t7+xr0ipTp9YxKQY4npwQ3mrRuL0BAVHBLyZxofhaKBAVtzmtRZ/zTyo0/to4B1uWG/Djg==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-darwin-x64": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-darwin-x64/-/lightningcss-darwin-x64-1.33.0.tgz",
+      "integrity": "sha512-Z5UPAxzrjlWNNyGy6i65cJzzvgJ5D3T6wMvs+gWpY9d7qRhANrxqAp6LhxIgZhWEw18RfJTGcRxjuLIBr+m8XQ==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-freebsd-x64": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-freebsd-x64/-/lightningcss-freebsd-x64-1.33.0.tgz",
+      "integrity": "sha512-QQM/Ti/hQajJwCY+RiWuCZ9sdtI/XQk7nDK5vC8kkdwixezOlDgvDx7+RT+QjK6FcFT4MpsuoBnHIo/O3StRRg==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-linux-arm-gnueabihf": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm-gnueabihf/-/lightningcss-linux-arm-gnueabihf-1.33.0.tgz",
+      "integrity": "sha512-N7FVBe6iS24MlM6R/4RBTxGhQheZGs7tiQ9U32UtF75NzP5Q7xWPRqLBCKxlRQRk3rY1jCIPLzx7WzOhuUIRLQ==",
+      "cpu": [
+        "arm"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-linux-arm64-gnu": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-gnu/-/lightningcss-linux-arm64-gnu-1.33.0.tgz",
+      "integrity": "sha512-j2v/itmy4HlNxlc6voKXYgBqNi0Ng2LShg4z7GufpEgs05P+2suBVyi9I6YHq5uoVFx9ETin3eCEhLVyXGQnKg==",
+      "cpu": [
+        "arm64"
+      ],
+      "libc": [
+        "glibc"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-linux-arm64-musl": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-musl/-/lightningcss-linux-arm64-musl-1.33.0.tgz",
+      "integrity": "sha512-yiO5ROMuYQgXbC60yjZU5CYSFZGKXL0HFATXt9mHJn1+zW55oCtMI9NfcVhYLMFDL7gV7oBPon/EmMMGg2OvtQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "libc": [
+        "musl"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-linux-x64-gnu": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-gnu/-/lightningcss-linux-x64-gnu-1.33.0.tgz",
+      "integrity": "sha512-ar+Ju7LmcN0Jo4FpL4hpFybwNG9/3A/Br5KW2n2jyODg3MEZXaDYADdemoNS+BDNfMgKvylJLj4S5tyRActuAg==",
+      "cpu": [
+        "x64"
+      ],
+      "libc": [
+        "glibc"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-linux-x64-musl": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-musl/-/lightningcss-linux-x64-musl-1.33.0.tgz",
+      "integrity": "sha512-RYiYbkokw0trfKqqzfF55lginwEPrD3OJDfTuJzFs1MK6iFnDenaz1fqLLtX4ITG3OktJQXOeTaw1awrBAlZPw==",
+      "cpu": [
+        "x64"
+      ],
+      "libc": [
+        "musl"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-win32-arm64-msvc": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-win32-arm64-msvc/-/lightningcss-win32-arm64-msvc-1.33.0.tgz",
+      "integrity": "sha512-1K+MPfLSFVpphzpdbfkhlWk6wBrTObBzS2T6db10PNOZgR9GoVsAWzwNyuhUYYbTp23j+4RrncfujZ4uAzXvwA==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-win32-x64-msvc": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-win32-x64-msvc/-/lightningcss-win32-x64-msvc-1.33.0.tgz",
+      "integrity": "sha512-OlEICDx/Xl0FqSp4bry8zFnCvGpig3Gl4gCquvYwHuqJKEC1+n9NgDniFvqHGmMv1ZkqDJrDqKKSykTDX+ehuA==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lilconfig": {
+      "version": "3.1.3",
+      "resolved": "https://registry.npmjs.org/lilconfig/-/lilconfig-3.1.3.tgz",
+      "integrity": "sha512-/vlFKAoH5Cgt3Ie+JLhRbwOsCQePABiU3tJ1egGvyQ+33R/vcwM2Zl2QR/LzjsBeItPt3oSVXapn+m4nQDvpzw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=14"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/antonk52"
+      }
+    },
+    "node_modules/lines-and-columns": {
+      "version": "1.2.4",
+      "resolved": "https://registry.npmjs.org/lines-and-columns/-/lines-and-columns-1.2.4.tgz",
+      "integrity": "sha512-7ylylesZQ/PV29jhEDl3Ufjo6ZX7gCqJr5F7PKrqc93v7fzSymt1BpwEU8nAUXs8qzzvqhbjhK5QZg6Mt/HkBg==",
+      "license": "MIT"
+    },
+    "node_modules/lucide-react": {
+      "version": "1.37.0",
+      "resolved": "https://registry.npmjs.org/lucide-react/-/lucide-react-1.37.0.tgz",
+      "integrity": "sha512-LPsB4rD1TD6wZu1djKOf9vUnS1jTNaHbolXebXDgiTdb6jeA1agIJhJsIybCmjKmQClcOaal1o1OaiYahEftyQ==",
+      "license": "ISC",
+      "peerDependencies": {
+        "react": "^16.5.1 || ^17.0.0 || ^18.0.0 || ^19.0.0"
+      }
+    },
+    "node_modules/merge2": {
+      "version": "1.4.1",
+      "resolved": "https://registry.npmjs.org/merge2/-/merge2-1.4.1.tgz",
+      "integrity": "sha512-8q7VEgMJW4J8tcfVPy8g09NcQwZdbwFEqhe/WZkoIzjn/3TGDwtOCYtXGxA3O8tPzpczCCDgv+P2P5y00ZJOOg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/micromatch": {
+      "version": "4.0.8",
+      "resolved": "https://registry.npmjs.org/micromatch/-/micromatch-4.0.8.tgz",
+      "integrity": "sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==",
+      "license": "MIT",
+      "dependencies": {
+        "braces": "^3.0.3",
+        "picomatch": "^2.3.1"
+      },
+      "engines": {
+        "node": ">=8.6"
+      }
+    },
+    "node_modules/mz": {
+      "version": "2.7.0",
+      "resolved": "https://registry.npmjs.org/mz/-/mz-2.7.0.tgz",
+      "integrity": "sha512-z81GNO7nnYMEhrGh9LeymoE4+Yr0Wn5McHIZMK5cfQCl+NDX08sCZgUc9/6MHni9IWuFLm1Z3HTCXu2z9fN62Q==",
+      "license": "MIT",
+      "dependencies": {
+        "any-promise": "^1.0.0",
+        "object-assign": "^4.0.1",
+        "thenify-all": "^1.0.0"
+      }
+    },
+    "node_modules/nanoid": {
+      "version": "3.3.18",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz",
+      "integrity": "sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "bin": {
+        "nanoid": "bin/nanoid.cjs"
+      },
+      "engines": {
+        "node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1"
+      }
+    },
+    "node_modules/node-releases": {
+      "version": "2.0.54",
+      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.54.tgz",
+      "integrity": "sha512-YHs7BmmcsdAI5Ozuf8JZo6PT0mv2GIWC9vMfvUC3dp65M8hn7Ux8CPL+2oBI7juNuj9d0ndhTcznq2ODBps9cQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/normalize-path": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/normalize-path/-/normalize-path-3.0.0.tgz",
+      "integrity": "sha512-6eZs5Ls3WtCisHWp9S2GUy8dqkpGi4BVSz3GaqiE6ezub0512ESztXUwUB6C6IKbQkY2Pnb/mD4WYojCRwcwLA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/object-assign": {
+      "version": "4.1.1",
+      "resolved": "https://registry.npmjs.org/object-assign/-/object-assign-4.1.1.tgz",
+      "integrity": "sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/object-hash": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/object-hash/-/object-hash-3.0.0.tgz",
+      "integrity": "sha512-RSn9F68PjH9HqtltsSnqYC1XXoWe9Bju5+213R98cNGttag9q9yAOTzdbsqvIa7aNm5WffBZFpWYr2aWrklWAw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/path-parse": {
+      "version": "1.0.7",
+      "resolved": "https://registry.npmjs.org/path-parse/-/path-parse-1.0.7.tgz",
+      "integrity": "sha512-LDJzPVEEEPR+y48z93A0Ed0yXb8pAByGWo/k5YYdYgpY2/2EsOsksJrq7lOHxryrVOn1ejG6oAp8ahvOIQD8sw==",
+      "license": "MIT"
+    },
+    "node_modules/picocolors": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
+      "integrity": "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==",
+      "license": "ISC"
+    },
+    "node_modules/picomatch": {
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz",
+      "integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=8.6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
+      }
+    },
+    "node_modules/pirates": {
+      "version": "4.0.7",
+      "resolved": "https://registry.npmjs.org/pirates/-/pirates-4.0.7.tgz",
+      "integrity": "sha512-TfySrs/5nm8fQJDcBDuUng3VOUKsd7S+zqvbOTiGXHfxX4wK31ard+hoNuvkicM/2YFzlpDgABOevKSsB4G/FA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/postcss": {
+      "version": "8.5.26",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.26.tgz",
+      "integrity": "sha512-u82N74LFzG8ca+dD8puPnplTXoGH4fTPpVGuIbt36G3qvNlkvfD0lEAZSxaly3KX8TS/L1A1gsCEmvKmBcVbkQ==",
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/postcss/"
+        },
+        {
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/postcss"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "nanoid": "^3.3.17",
+        "picocolors": "^1.1.1",
+        "source-map-js": "^1.2.1"
+      },
+      "engines": {
+        "node": "^10 || ^12 || >=14"
+      }
+    },
+    "node_modules/postcss-import": {
+      "version": "15.1.0",
+      "resolved": "https://registry.npmjs.org/postcss-import/-/postcss-import-15.1.0.tgz",
+      "integrity": "sha512-hpr+J05B2FVYUAXHeK1YyI267J/dDDhMU6B6civm8hSY1jYJnBXxzKDKDswzJmtLHryrjhnDjqqp/49t8FALew==",
+      "license": "MIT",
+      "dependencies": {
+        "postcss-value-parser": "^4.0.0",
+        "read-cache": "^1.0.0",
+        "resolve": "^1.1.7"
+      },
+      "engines": {
+        "node": ">=14.0.0"
+      },
+      "peerDependencies": {
+        "postcss": "^8.0.0"
+      }
+    },
+    "node_modules/postcss-js": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/postcss-js/-/postcss-js-4.1.0.tgz",
+      "integrity": "sha512-oIAOTqgIo7q2EOwbhb8UalYePMvYoIeRY2YKntdpFQXNosSu3vLrniGgmH9OKs/qAkfoj5oB3le/7mINW1LCfw==",
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/postcss/"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "camelcase-css": "^2.0.1"
+      },
+      "engines": {
+        "node": "^12 || ^14 || >= 16"
+      },
+      "peerDependencies": {
+        "postcss": "^8.4.21"
+      }
+    },
+    "node_modules/postcss-load-config": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/postcss-load-config/-/postcss-load-config-6.0.1.tgz",
+      "integrity": "sha512-oPtTM4oerL+UXmx+93ytZVN82RrlY/wPUV8IeDxFrzIjXOLF1pN+EmKPLbubvKHT2HC20xXsCAH2Z+CKV6Oz/g==",
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/postcss/"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "lilconfig": "^3.1.1"
+      },
+      "engines": {
+        "node": ">= 18"
+      },
+      "peerDependencies": {
+        "jiti": ">=1.21.0",
+        "postcss": ">=8.0.9",
+        "tsx": "^4.8.1",
+        "yaml": "^2.4.2"
+      },
+      "peerDependenciesMeta": {
+        "jiti": {
+          "optional": true
+        },
+        "postcss": {
+          "optional": true
+        },
+        "tsx": {
+          "optional": true
+        },
+        "yaml": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/postcss-nested": {
+      "version": "6.2.0",
+      "resolved": "https://registry.npmjs.org/postcss-nested/-/postcss-nested-6.2.0.tgz",
+      "integrity": "sha512-HQbt28KulC5AJzG+cZtj9kvKB93CFCdLvog1WFLf1D+xmMvPGlBstkpTEZfK5+AN9hfJocyBFCNiqyS48bpgzQ==",
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/postcss/"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "postcss-selector-parser": "^6.1.1"
+      },
+      "engines": {
+        "node": ">=12.0"
+      },
+      "peerDependencies": {
+        "postcss": "^8.2.14"
+      }
+    },
+    "node_modules/postcss-selector-parser": {
+      "version": "6.1.4",
+      "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.4.tgz",
+      "integrity": "sha512-bIoJLOmjCO1S9XdY/DcnR5hJxvrDir1PbGChrzXG3vw0/FOliy/fA3dmdhQ441kah4gKv+TwckGzex6wNS5cnQ==",
+      "license": "MIT",
+      "dependencies": {
+        "cssesc": "^3.0.0",
+        "util-deprecate": "^1.0.2"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/postcss-value-parser": {
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/postcss-value-parser/-/postcss-value-parser-4.2.0.tgz",
+      "integrity": "sha512-1NNCs6uurfkVbeXG4S8JFT9t19m45ICnif8zWLd5oPSZ50QnwMfK+H3jv408d4jw/7Bttv5axS5IiHoLaVNHeQ==",
+      "license": "MIT"
+    },
+    "node_modules/queue-microtask": {
+      "version": "1.2.3",
+      "resolved": "https://registry.npmjs.org/queue-microtask/-/queue-microtask-1.2.3.tgz",
+      "integrity": "sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/react": {
+      "version": "19.2.8",
+      "resolved": "https://registry.npmjs.org/react/-/react-19.2.8.tgz",
+      "integrity": "sha512-PWaYA1L/q9u2u7xYQi+Y3L3Yfnie7XyLeaJICV1MGD6LprsBxcAqGjYyr0eY3p+QdsA+x/Irkt4Qif8D63+Sbw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/react-dom": {
+      "version": "19.2.8",
+      "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-19.2.8.tgz",
+      "integrity": "sha512-rVprimfGBG3DR+Tq0IQG2DT5PxKth1WIGDmj5yPmlzr4YBe7uyE+Du4oVqTDXZSHGGGXRtTJEGSSePyQCMBglQ==",
+      "license": "MIT",
+      "dependencies": {
+        "scheduler": "^0.27.0"
+      },
+      "peerDependencies": {
+        "react": "^19.2.8"
+      }
+    },
+    "node_modules/read-cache": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/read-cache/-/read-cache-1.0.2.tgz",
+      "integrity": "sha512-/peqiBB/n07gQGLsWaHho3WfvUyRscw0gYTsEFMhrIe/nWLkYaf5SbKYjGYqtRV3aPwykJgF2VEMo1ac4bnsGA==",
+      "license": "MIT"
+    },
+    "node_modules/readdirp": {
+      "version": "3.6.0",
+      "resolved": "https://registry.npmjs.org/readdirp/-/readdirp-3.6.0.tgz",
+      "integrity": "sha512-hOS089on8RduqdbhvQ5Z37A0ESjsqz6qnRcffsMU3495FuTdqSm+7bhJ29JvIOsBDEEnan5DPu9t3To9VRlMzA==",
+      "license": "MIT",
+      "dependencies": {
+        "picomatch": "^2.2.1"
+      },
+      "engines": {
+        "node": ">=8.10.0"
+      }
+    },
+    "node_modules/resolve": {
+      "version": "1.22.12",
+      "resolved": "https://registry.npmjs.org/resolve/-/resolve-1.22.12.tgz",
+      "integrity": "sha512-TyeJ1zif53BPfHootBGwPRYT1RUt6oGWsaQr8UyZW/eAm9bKoijtvruSDEmZHm92CwS9nj7/fWttqPCgzep8CA==",
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "is-core-module": "^2.16.1",
+        "path-parse": "^1.0.7",
+        "supports-preserve-symlinks-flag": "^1.0.0"
+      },
+      "bin": {
+        "resolve": "bin/resolve"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/reusify": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/reusify/-/reusify-1.1.0.tgz",
+      "integrity": "sha512-g6QUff04oZpHs0eG5p83rFLhHeV00ug/Yf9nZM6fLeUrPguBTkTQOdpAWWspMh55TZfVQDPaN3NQJfbVRAxdIw==",
+      "license": "MIT",
+      "engines": {
+        "iojs": ">=1.0.0",
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/rolldown": {
+      "version": "1.2.6",
+      "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.2.6.tgz",
+      "integrity": "sha512-vMM4q3aixf46GiF1Kok8jDPFsEpXgFWGjUHXNkNHNm+Y2adXAG2dbX91jkti3i0ZRsOlcmbuzAz1poObSHCmUA==",
+      "license": "MIT",
+      "dependencies": {
+        "@oxc-project/types": "=0.147.0",
+        "@rolldown/pluginutils": "^1.0.0"
+      },
+      "bin": {
+        "rolldown": "bin/cli.mjs"
+      },
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      },
+      "optionalDependencies": {
+        "@rolldown/binding-android-arm-eabi": "1.2.6",
+        "@rolldown/binding-android-arm64": "1.2.6",
+        "@rolldown/binding-darwin-arm64": "1.2.6",
+        "@rolldown/binding-darwin-x64": "1.2.6",
+        "@rolldown/binding-freebsd-x64": "1.2.6",
+        "@rolldown/binding-linux-arm-gnueabihf": "1.2.6",
+        "@rolldown/binding-linux-arm64-gnu": "1.2.6",
+        "@rolldown/binding-linux-arm64-musl": "1.2.6",
+        "@rolldown/binding-linux-ppc64-gnu": "1.2.6",
+        "@rolldown/binding-linux-s390x-gnu": "1.2.6",
+        "@rolldown/binding-linux-x64-gnu": "1.2.6",
+        "@rolldown/binding-linux-x64-musl": "1.2.6",
+        "@rolldown/binding-openharmony-arm64": "1.2.6",
+        "@rolldown/binding-win32-arm64-msvc": "1.2.6",
+        "@rolldown/binding-win32-x64-msvc": "1.2.6"
+      }
+    },
+    "node_modules/run-parallel": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/run-parallel/-/run-parallel-1.2.0.tgz",
+      "integrity": "sha512-5l4VyZR86LZ/lDxZTR6jqL8AFE2S0IFLMP26AbjsLVADxHdhB/c0GUsH+y39UfCi3dzz8OlQuPmnaJOMoDHQBA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "queue-microtask": "^1.2.2"
+      }
+    },
+    "node_modules/scheduler": {
+      "version": "0.27.0",
+      "resolved": "https://registry.npmjs.org/scheduler/-/scheduler-0.27.0.tgz",
+      "integrity": "sha512-eNv+WrVbKu1f3vbYJT/xtiF5syA5HPIMtf9IgY/nKg0sWqzAUEvqY/xm7OcZc/qafLx/iO9FgOmeSAp4v5ti/Q==",
+      "license": "MIT"
+    },
+    "node_modules/source-map-js": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz",
+      "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==",
+      "license": "BSD-3-Clause",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/sucrase": {
+      "version": "3.35.1",
+      "resolved": "https://registry.npmjs.org/sucrase/-/sucrase-3.35.1.tgz",
+      "integrity": "sha512-DhuTmvZWux4H1UOnWMB3sk0sbaCVOoQZjv8u1rDoTV0HTdGem9hkAZtl4JZy8P2z4Bg0nT+YMeOFyVr4zcG5Tw==",
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/gen-mapping": "^0.3.2",
+        "commander": "^4.0.0",
+        "lines-and-columns": "^1.1.6",
+        "mz": "^2.7.0",
+        "pirates": "^4.0.1",
+        "tinyglobby": "^0.2.11",
+        "ts-interface-checker": "^0.1.9"
+      },
+      "bin": {
+        "sucrase": "bin/sucrase",
+        "sucrase-node": "bin/sucrase-node"
+      },
+      "engines": {
+        "node": ">=16 || 14 >=14.17"
+      }
+    },
+    "node_modules/supports-preserve-symlinks-flag": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/supports-preserve-symlinks-flag/-/supports-preserve-symlinks-flag-1.0.0.tgz",
+      "integrity": "sha512-ot0WnXS9fgdkgIcePe6RHNk1WA8+muPa6cSjeR3V8K27q9BB1rTE3R1p7Hv0z1ZyAc8s6Vvv8DIyWf681MAt0w==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/tailwindcss": {
+      "version": "3.4.19",
+      "resolved": "https://registry.npmjs.org/tailwindcss/-/tailwindcss-3.4.19.tgz",
+      "integrity": "sha512-3ofp+LL8E+pK/JuPLPggVAIaEuhvIz4qNcf3nA1Xn2o/7fb7s/TYpHhwGDv1ZU3PkBluUVaF8PyCHcm48cKLWQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@alloc/quick-lru": "^5.2.0",
+        "arg": "^5.0.2",
+        "chokidar": "^3.6.0",
+        "didyoumean": "^1.2.2",
+        "dlv": "^1.1.3",
+        "fast-glob": "^3.3.2",
+        "glob-parent": "^6.0.2",
+        "is-glob": "^4.0.3",
+        "jiti": "^1.21.7",
+        "lilconfig": "^3.1.3",
+        "micromatch": "^4.0.8",
+        "normalize-path": "^3.0.0",
+        "object-hash": "^3.0.0",
+        "picocolors": "^1.1.1",
+        "postcss": "^8.4.47",
+        "postcss-import": "^15.1.0",
+        "postcss-js": "^4.0.1",
+        "postcss-load-config": "^4.0.2 || ^5.0 || ^6.0",
+        "postcss-nested": "^6.2.0",
+        "postcss-selector-parser": "^6.1.2",
+        "resolve": "^1.22.8",
+        "sucrase": "^3.35.0"
+      },
+      "bin": {
+        "tailwind": "lib/cli.js",
+        "tailwindcss": "lib/cli.js"
+      },
+      "engines": {
+        "node": ">=14.0.0"
+      }
+    },
+    "node_modules/thenify": {
+      "version": "3.3.1",
+      "resolved": "https://registry.npmjs.org/thenify/-/thenify-3.3.1.tgz",
+      "integrity": "sha512-RVZSIV5IG10Hk3enotrhvz0T9em6cyHBLkH/YAZuKqd8hRkKhSfCGIcP2KUY0EPxndzANBmNllzWPwak+bheSw==",
+      "license": "MIT",
+      "dependencies": {
+        "any-promise": "^1.0.0"
+      }
+    },
+    "node_modules/thenify-all": {
+      "version": "1.6.0",
+      "resolved": "https://registry.npmjs.org/thenify-all/-/thenify-all-1.6.0.tgz",
+      "integrity": "sha512-RNxQH/qI8/t3thXJDwcstUO4zeqo64+Uy/+sNVRBx4Xn2OX+OZ9oP+iJnNFqplFra2ZUVeKCSa2oVWi3T4uVmA==",
+      "license": "MIT",
+      "dependencies": {
+        "thenify": ">= 3.1.0 < 4"
+      },
+      "engines": {
+        "node": ">=0.8"
+      }
+    },
+    "node_modules/tinyglobby": {
+      "version": "0.2.17",
+      "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.17.tgz",
+      "integrity": "sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==",
+      "license": "MIT",
+      "dependencies": {
+        "fdir": "^6.5.0",
+        "picomatch": "^4.0.4"
+      },
+      "engines": {
+        "node": ">=12.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/SuperchupuDev"
+      }
+    },
+    "node_modules/tinyglobby/node_modules/fdir": {
+      "version": "6.5.0",
+      "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz",
+      "integrity": "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=12.0.0"
+      },
+      "peerDependencies": {
+        "picomatch": "^3 || ^4"
+      },
+      "peerDependenciesMeta": {
+        "picomatch": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/tinyglobby/node_modules/picomatch": {
+      "version": "4.0.7",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.7.tgz",
+      "integrity": "sha512-qcJu88Q2IWqJsDD529JKMdwGm/dvInW4HvQnRwiH9JtihJvzGOscDtHE3x1pBKeUOTysQ8kVmLnJ2kJu7yhcGA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
+      }
+    },
+    "node_modules/to-regex-range": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/to-regex-range/-/to-regex-range-5.0.1.tgz",
+      "integrity": "sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==",
+      "license": "MIT",
+      "dependencies": {
+        "is-number": "^7.0.0"
+      },
+      "engines": {
+        "node": ">=8.0"
+      }
+    },
+    "node_modules/ts-interface-checker": {
+      "version": "0.1.13",
+      "resolved": "https://registry.npmjs.org/ts-interface-checker/-/ts-interface-checker-0.1.13.tgz",
+      "integrity": "sha512-Y/arvbn+rrz3JCKl9C4kVNfTfSm2/mEp5FSz5EsZSANGPSlQrpRI5M4PKF+mJnE52jOO90PnPSc3Ur3bTQw0gA==",
+      "license": "Apache-2.0"
+    },
+    "node_modules/update-browserslist-db": {
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.3.2.tgz",
+      "integrity": "sha512-UQ+MSxlhRm1bzjhU+DcuXfjFO1FzNtqhK5+9Yvlp90ItDLk5vT932A0rFu619nf7RVS+Y/VeaUW1jaRDqZ8VJw==",
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/browserslist"
+        },
+        {
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/browserslist"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "escalade": "^3.2.0",
+        "picocolors": "^1.1.1"
+      },
+      "bin": {
+        "update-browserslist-db": "cli.js"
+      },
+      "peerDependencies": {
+        "browserslist": ">= 4.21.0"
+      }
+    },
+    "node_modules/util-deprecate": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz",
+      "integrity": "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==",
+      "license": "MIT"
+    },
+    "node_modules/vite": {
+      "version": "8.2.2",
+      "resolved": "https://registry.npmjs.org/vite/-/vite-8.2.2.tgz",
+      "integrity": "sha512-cFKLV/PRgAUlIRm5WjMjJ86jrftzpqcgH+Us+DS8mI3CDNiH30Whrz8uHL3+MOLPAgqbMBAqWdAHAphOAM+z/Q==",
+      "license": "MIT",
+      "dependencies": {
+        "lightningcss": "^1.33.0",
+        "picomatch": "^4.0.5",
+        "postcss": "^8.5.26",
+        "rolldown": "~1.2.4",
+        "tinyglobby": "^0.2.17"
+      },
+      "bin": {
+        "vite": "bin/vite.js"
+      },
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      },
+      "funding": {
+        "url": "https://github.com/vitejs/vite?sponsor=1"
+      },
+      "optionalDependencies": {
+        "fsevents": "~2.3.3"
+      },
+      "peerDependencies": {
+        "@types/node": "^20.19.0 || >=22.12.0",
+        "@vitejs/devtools": "^0.4.0 || ^0.5.0",
+        "esbuild": "^0.27.0 || ^0.28.0",
+        "jiti": ">=1.21.0",
+        "less": "^4.0.0",
+        "sass": "^1.70.0",
+        "sass-embedded": "^1.70.0",
+        "stylus": ">=0.54.8",
+        "sugarss": "^5.0.0",
+        "terser": "^5.16.0",
+        "tsx": "^4.8.1",
+        "yaml": "^2.4.2"
+      },
+      "peerDependenciesMeta": {
+        "@types/node": {
+          "optional": true
+        },
+        "@vitejs/devtools": {
+          "optional": true
+        },
+        "esbuild": {
+          "optional": true
+        },
+        "jiti": {
+          "optional": true
+        },
+        "less": {
+          "optional": true
+        },
+        "sass": {
+          "optional": true
+        },
+        "sass-embedded": {
+          "optional": true
+        },
+        "stylus": {
+          "optional": true
+        },
+        "sugarss": {
+          "optional": true
+        },
+        "terser": {
+          "optional": true
+        },
+        "tsx": {
+          "optional": true
+        },
+        "yaml": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/vite/node_modules/picomatch": {
+      "version": "4.0.7",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.7.tgz",
+      "integrity": "sha512-qcJu88Q2IWqJsDD529JKMdwGm/dvInW4HvQnRwiH9JtihJvzGOscDtHE3x1pBKeUOTysQ8kVmLnJ2kJu7yhcGA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
+      }
+    }
+  }
+}
diff --git a/web/package.json b/web/package.json
new file mode 100644
index 0000000..110eb26
--- /dev/null
+++ b/web/package.json
@@ -0,0 +1,22 @@
+{
+  "name": "configcenter-web",
+  "private": true,
+  "version": "0.1.0",
+  "type": "module",
+  "scripts": {
+    "dev": "vite",
+    "build": "vite build",
+    "preview": "vite preview"
+  },
+  "dependencies": {
+    "@vitejs/plugin-react": "latest",
+    "autoprefixer": "latest",
+    "lucide-react": "latest",
+    "postcss": "latest",
+    "react": "latest",
+    "react-dom": "latest",
+    "tailwindcss": "^3.4.17",
+    "vite": "latest"
+  },
+  "devDependencies": {}
+}
diff --git a/web/postcss.config.js b/web/postcss.config.js
new file mode 100644
index 0000000..2aa7205
--- /dev/null
+++ b/web/postcss.config.js
@@ -0,0 +1,6 @@
+export default {
+  plugins: {
+    tailwindcss: {},
+    autoprefixer: {},
+  },
+};
diff --git a/web/src/api.js b/web/src/api.js
new file mode 100644
index 0000000..23ca68b
--- /dev/null
+++ b/web/src/api.js
@@ -0,0 +1,196 @@
+const API_ROOT = (import.meta.env.VITE_API_BASE_URL || '').replace(/\/$/, '');
+const TOKEN_KEY = 'configcenter.accessToken';
+let unauthorizedHandler = null;
+
+function accessToken() {
+  return window.sessionStorage.getItem(TOKEN_KEY) || '';
+}
+
+class ApiError extends Error {
+  constructor(message, status, code) {
+    super(message);
+    this.name = 'ApiError';
+    this.status = status;
+    this.code = code;
+  }
+}
+
+function normalizeId(value) {
+  return value == null ? value : String(value);
+}
+
+function localTime(value, dateOnly = false) {
+  if (!value) return '';
+  const date = new Date(value);
+  if (Number.isNaN(date.getTime())) return value;
+  if (dateOnly) return date.toLocaleDateString('zh-CN');
+  return date.toLocaleString('zh-CN', { hour12: false });
+}
+
+function app(item) {
+  return { ...item, id: normalizeId(item.id), createdAt: localTime(item.createdAt, true), updatedAt: localTime(item.updatedAt) };
+}
+
+function env(item) {
+  return { ...item, id: normalizeId(item.id) };
+}
+
+function namespace(item) {
+  return { ...item, id: normalizeId(item.id), appId: normalizeId(item.appId) };
+}
+
+function config(item) {
+  return {
+    ...item,
+    id: normalizeId(item.id),
+    appId: normalizeId(item.appId),
+    nsId: normalizeId(item.nsId),
+    envId: normalizeId(item.envId),
+    updatedAt: localTime(item.updatedAt),
+  };
+}
+
+function release(item) {
+  return {
+    ...item,
+    id: normalizeId(item.id),
+    appId: normalizeId(item.appId),
+    nsId: normalizeId(item.nsId),
+    envId: normalizeId(item.envId),
+    time: localTime(item.time),
+  };
+}
+
+function grayRule(item) {
+  return {
+    ...item,
+    id: normalizeId(item.id),
+    appId: normalizeId(item.appId),
+    nsId: normalizeId(item.nsId),
+    envId: normalizeId(item.envId),
+    createdAt: localTime(item.createdAt),
+  };
+}
+
+async function request(path, options = {}) {
+  const token = accessToken();
+  const response = await fetch(`${API_ROOT}${path}`, {
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      'X-User': 'admin',
+      ...(token ? { Authorization: `Bearer ${token}` } : {}),
+      ...options.headers,
+    },
+  });
+  if (!response.ok) {
+    let message = `请求失败 (${response.status})`;
+    let code = 'http_error';
+    try {
+      const payload = await response.json();
+      message = payload.error?.message || message;
+      code = payload.error?.code || code;
+    } catch {
+      // Keep the HTTP status based fallback.
+    }
+    const error = new ApiError(message, response.status, code);
+    if (response.status === 401 && path !== '/v1/auth/login') {
+      window.sessionStorage.removeItem(TOKEN_KEY);
+      unauthorizedHandler?.();
+    }
+    throw error;
+  }
+  if (response.status === 204) return null;
+  const payload = await response.json();
+  return payload.data ?? payload;
+}
+
+function json(method, body) {
+  return { method, body: JSON.stringify(body) };
+}
+
+function scopeQuery(appId, nsId, envId) {
+  return new URLSearchParams({ appId, nsId, envId }).toString();
+}
+
+export const api = {
+  setToken(token) {
+    if (token) window.sessionStorage.setItem(TOKEN_KEY, token);
+    else window.sessionStorage.removeItem(TOKEN_KEY);
+  },
+  onUnauthorized(handler) {
+    unauthorizedHandler = handler;
+    return () => { if (unauthorizedHandler === handler) unauthorizedHandler = null; };
+  },
+  hasToken: () => Boolean(accessToken()),
+  login: (username, password) => request('/v1/auth/login', json('POST', { username, password })),
+  me: () => request('/v1/me'),
+  async bootstrap() {
+    const [apps, environments, namespaces, identity] = await Promise.all([
+      request('/v1/applications'),
+      request('/v1/environments'),
+      request('/v1/namespaces'),
+      request('/v1/me'),
+    ]);
+    return {
+      apps: apps.map(app),
+      environments: environments.map(env),
+      namespaces: namespaces.map(namespace),
+      identity,
+    };
+  },
+
+  createApplication: (input) => request('/v1/applications', json('POST', input)).then(app),
+  updateApplication: (id, input) => request(`/v1/applications/${id}`, json('PUT', input)).then(app),
+  deleteApplication: (id) => request(`/v1/applications/${id}`, { method: 'DELETE' }),
+
+  createEnvironment: (input) => request('/v1/environments', json('POST', input)).then(env),
+  updateEnvironment: (id, input) => request(`/v1/environments/${id}`, json('PUT', input)).then(env),
+  deleteEnvironment: (id) => request(`/v1/environments/${id}`, { method: 'DELETE' }),
+
+  createNamespace: (input) => request('/v1/namespaces', json('POST', { ...input, appId: Number(input.appId) })).then(namespace),
+  updateNamespace: (id, input) => request(`/v1/namespaces/${id}`, json('PUT', input)).then(namespace),
+  deleteNamespace: (id) => request(`/v1/namespaces/${id}`, { method: 'DELETE' }),
+
+  async listConfigItems(appId, nsId, envId) {
+    const data = await request(`/v1/config-items?${scopeQuery(appId, nsId, envId)}`);
+    return data.map(config);
+  },
+  createConfigItem: (input) => request('/v1/config-items', json('POST', {
+    ...input,
+    appId: Number(input.appId),
+    nsId: Number(input.nsId),
+    envId: Number(input.envId),
+  })).then(config),
+  updateConfigItem: (id, input) => request(`/v1/config-items/${id}`, json('PUT', input)).then(config),
+  deleteConfigItem: (id) => request(`/v1/config-items/${id}`, { method: 'DELETE' }).then(config),
+  restoreConfigItem: (id) => request(`/v1/config-items/${id}/restore`, { method: 'POST' }).then(config),
+
+  async listReleases(appId, nsId, envId) {
+    const data = await request(`/v1/releases?${scopeQuery(appId, nsId, envId)}`);
+    return data.map(release);
+  },
+  publish: (input) => request('/v1/publish', json('POST', {
+    appId: Number(input.appId), nsId: Number(input.nsId), envId: Number(input.envId), comment: input.comment,
+  })).then(release),
+  rollback: (input) => request('/v1/rollback', json('POST', {
+    appId: Number(input.appId), nsId: Number(input.nsId), envId: Number(input.envId), targetVersion: input.targetVersion,
+  })).then(release),
+  getRelease: (id) => request(`/v1/releases/${id}`).then(release),
+
+  async listGrayRules(appId, nsId, envId) {
+    const data = await request(`/v1/gray-rules?${scopeQuery(appId, nsId, envId)}`);
+    return data.map(grayRule);
+  },
+  createGrayRule: (input) => request('/v1/gray-rules', json('POST', {
+    ...input, appId: Number(input.appId), nsId: Number(input.nsId), envId: Number(input.envId),
+  })).then(grayRule),
+  updateGrayRule: (id, input) => request(`/v1/gray-rules/${id}`, json('PUT', input)).then(grayRule),
+  deleteGrayRule: (id) => request(`/v1/gray-rules/${id}`, { method: 'DELETE' }),
+
+  listUsers: () => request('/v1/users'),
+  createUser: (input) => request('/v1/users', json('POST', input)),
+  listUserRoles: (id) => request(`/v1/users/${id}/roles`),
+  setUserRole: (userId, appId, role) => request(`/v1/users/${userId}/roles/${appId}`, json('PUT', { role })),
+  deleteUserRole: (userId, appId) => request(`/v1/users/${userId}/roles/${appId}`, { method: 'DELETE' }),
+};
diff --git a/web/src/index.css b/web/src/index.css
new file mode 100644
index 0000000..91e523a
--- /dev/null
+++ b/web/src/index.css
@@ -0,0 +1,22 @@
+@tailwind base;
+@tailwind components;
+@tailwind utilities;
+
+html,
+body,
+#root {
+  height: 100%;
+  margin: 0;
+}
+
+body {
+  min-width: 720px;
+  background: #f8fafc;
+}
+
+button,
+input,
+select,
+textarea {
+  font: inherit;
+}
diff --git a/web/src/main.jsx b/web/src/main.jsx
new file mode 100644
index 0000000..ac3d00f
--- /dev/null
+++ b/web/src/main.jsx
@@ -0,0 +1,10 @@
+import React from 'react';
+import ReactDOM from 'react-dom/client';
+import ConfigCenter from '../../ConfigCenter.jsx';
+import './index.css';
+
+ReactDOM.createRoot(document.getElementById('root')).render(
+  <React.StrictMode>
+    <ConfigCenter />
+  </React.StrictMode>,
+);
diff --git a/web/tailwind.config.js b/web/tailwind.config.js
new file mode 100644
index 0000000..98737f1
--- /dev/null
+++ b/web/tailwind.config.js
@@ -0,0 +1,6 @@
+/** @type {import('tailwindcss').Config} */
+export default {
+  content: ['./index.html', './src/**/*.{js,jsx}', '../ConfigCenter.jsx'],
+  theme: { extend: {} },
+  plugins: [],
+};
diff --git a/web/vite.config.js b/web/vite.config.js
new file mode 100644
index 0000000..b635477
--- /dev/null
+++ b/web/vite.config.js
@@ -0,0 +1,21 @@
+import { defineConfig } from 'vite';
+import react from '@vitejs/plugin-react';
+import { fileURLToPath, URL } from 'node:url';
+
+export default defineConfig({
+  plugins: [react()],
+  resolve: {
+    alias: {
+      react: fileURLToPath(new URL('./node_modules/react', import.meta.url)),
+      'lucide-react': fileURLToPath(new URL('./node_modules/lucide-react', import.meta.url)),
+    },
+  },
+  server: {
+    port: 5173,
+    proxy: {
+      '/v1': 'http://localhost:8080',
+      '/health': 'http://localhost:8080',
+    },
+    fs: { allow: ['..'] },
+  },
+});