@abtnode/core 1.17.7-beta-20251227-001958-ea2ba3f5 → 1.17.7-beta-20251229-223813-e1e6c5e3

package/lib/router/helper.js

@@ -1,11 +1,12 @@
+/* eslint-disable no-use-before-define */
 /* eslint-disable no-restricted-syntax */
 /* eslint-disable prefer-destructuring */
 const fs = require('fs-extra');
 const path = require('path');
 const tar = require('tar');
+const dns = require('dns').promises;
 const UUID = require('uuid');
 const dayjs = require('@abtnode/util/lib/dayjs');
-const isUrl = require('is-url');
 const get = require('lodash/get');
 const cloneDeep = require('@abtnode/util/lib/deep-clone');
 const groupBy = require('lodash/groupBy');
@@ -26,7 +27,8 @@ const normalizePathPrefix = require('@abtnode/util/lib/normalize-path-prefix');
 const getTmpDir = require('@abtnode/util/lib/get-tmp-directory');
 const downloadFile = require('@abtnode/util/lib/download-file');
 const axios = require('@abtnode/util/lib/axios');
-const { getIpDnsDomainForBlocklet } = require('@abtnode/util/lib/get-domain-for-blocklet');
+const { getIpDnsDomainForBlocklet, getDidDomainForBlocklet } = require('@abtnode/util/lib/get-domain-for-blocklet');
+const { hasMountPoint } = require('@blocklet/meta/lib/engine');
 const { forEachBlockletSync } = require('@blocklet/meta/lib/util');
 const { processLogByDate } = require('@abtnode/analytics');
 const { DBCache, getAbtNodeRedisAndSQLiteUrl } = require('@abtnode/db-cache');
@@ -43,7 +45,6 @@ const {
   NAME_FOR_WELLKNOWN_SITE,
   ROUTING_RULE_TYPES,
   CERTIFICATE_EXPIRES_OFFSET,
-  DEFAULT_SERVICE_PATH,
   SLOT_FOR_IP_DNS_SITE,
   BLOCKLET_SITE_GROUP_SUFFIX,
   WELLKNOWN_ACME_CHALLENGE_PREFIX,
@@ -57,6 +58,8 @@ const {
   DEFAULT_IP_DOMAIN,
   WELLKNOWN_BLACKLIST_PREFIX,
   NODE_MODES,
+  ACCESS_POLICY_PUBLIC,
+  DEFAULT_DID_DOMAIN,
 } = require('@abtnode/constant');
 const {
   BLOCKLET_DYNAMIC_PATH_PREFIX,
@@ -64,17 +67,15 @@ const {
   BLOCKLET_INTERFACE_PUBLIC,
   BLOCKLET_INTERFACE_WELLKNOWN,
   BLOCKLET_INTERFACE_TYPE_WELLKNOWN,
-  BLOCKLET_CONFIGURABLE_KEY,
   BlockletEvents,
   BLOCKLET_MODES,
 } = require('@blocklet/constant');
-const { isInstanceWorker } = require('@abtnode/util/lib/pm2/is-instance-worker');
+const { isWorkerInstance } = require('@abtnode/util/lib/pm2/is-instance-worker');
 
 const pkg = require('../../package.json');
 // eslint-disable-next-line
 const logger = require('@abtnode/logger')(`${pkg.name}:router:helper`);
 const {
-  getProviderFromNodeInfo,
   getHttpsCertInfo,
   findInterfacePortByName,
   getWellknownSitePort,
@@ -103,6 +104,7 @@ const {
 } = require('../util/blocklet');
 const { toCamelCase } = require('../util/index');
 const { get: getIp } = require('../util/ip');
+const { getBlockletSecurityRules } = require('../blocklet/security/security-rule');
 
 const isServiceFeDevelopment = process.env.ABT_NODE_SERVICE_FE_PORT;
 
@@ -217,57 +219,9 @@ const attachRuntimeDomainAliases = async ({ sites = [], context = {} }) => {
   });
 };
 
-/**
- * @description
- * @param {{
- *  corsAllowedOrigins: Array<string>;
- * }} site
- * @param {string} rawUrl
- * @return {void}
- */
-const addCorsToSite = (site, rawUrl) => {
-  if (!site || !rawUrl) {
-    return;
-  }
-  try {
-    const url = new URL(rawUrl);
-    if (!Array.isArray(site.corsAllowedOrigins)) {
-      site.corsAllowedOrigins = [];
-    }
-
-    if (!site.corsAllowedOrigins.includes(url.hostname)) {
-      site.corsAllowedOrigins.push(url.hostname);
-    }
-  } catch (err) {
-    console.error('addCorsToSite', err);
-  }
-};
-
 const isBasicSite = (domain) =>
   [DOMAIN_FOR_INTERNAL_SITE, DOMAIN_FOR_IP_SITE, DOMAIN_FOR_DEFAULT_SITE, DOMAIN_FOR_IP_SITE_REGEXP].includes(domain);
 
-/**
- * add rule of directly proxy to abtnode-service for default site
- */
-const ensureServiceRule = async (sites) => {
-  const info = await states.node.read();
-  return sites.map((site) => {
-    if (
-      [DOMAIN_FOR_IP_SITE, DOMAIN_FOR_IP_SITE_REGEXP].includes(site.domain) &&
-      !site.rules.some((r) => r.from.pathPrefix === DEFAULT_SERVICE_PATH)
-    ) {
-      site.rules.push({
-        from: { pathPrefix: DEFAULT_SERVICE_PATH },
-        to: {
-          port: process.env.ABT_NODE_SERVICE_PORT,
-          type: ROUTING_RULE_TYPES.SERVICE,
-          did: info.did,
-        },
-      });
-    }
-    return site;
-  });
-};
 const ensureRootRule = (sites) => {
   return sites.map((site) => {
     if (!isBasicSite(site.domain) && !site.rules.some((x) => x.from.pathPrefix === '/')) {
@@ -282,8 +236,7 @@ const ensureRootRule = (sites) => {
   });
 };
 
-const ensureLatestNodeInfo = async (sites = [], { withDefaultCors = true } = {}) => {
-  const info = await states.node.read();
+const ensureLatestNodeInfo = (sites = [], info) => {
   return sites.map((site) => {
     site.rules = site.rules.map((rule) => {
       if (rule.to.did === info.did && rule.to.type === ROUTING_RULE_TYPES.DAEMON) {
@@ -300,14 +253,6 @@ const ensureLatestNodeInfo = async (sites = [], { withDefaultCors = true } = {})
       // We use an regular expression to match ip domain so that it is adaptive
       // @ref https://stackoverflow.com/questions/9454764/nginx-server-name-wildcard-or-catch-all
       site.domain = DOMAIN_FOR_IP_SITE_REGEXP;
-
-      if (withDefaultCors) {
-        // Allow CORS from "Install on ABT Node"
-        addCorsToSite(site, info.registerUrl);
-
-        // Allow CORS from "Web Wallet"
-        addCorsToSite(site, info.webWalletUrl);
-      }
     }
 
     return site;
@@ -317,9 +262,8 @@ const ensureLatestNodeInfo = async (sites = [], { withDefaultCors = true } = {})
 /**
  * set rule.to.target by interface.path and interface.prefix
  */
-const ensureLatestInterfaceInfo = async (sites = []) => {
-  // FIXME @linchen groupAllInterfaces() may have performance issue
-  const interfaces = await states.blocklet.groupAllInterfaces();
+const ensureLatestInterfaceInfo = async (sites = [], blocklets = []) => {
+  const interfaces = await states.blocklet.groupAllInterfaces(blocklets);
   return sites.map((site) => {
     if (!Array.isArray(site.rules)) {
       return site;
@@ -370,6 +314,7 @@ const ensureWellknownRule = async (sites = []) => {
             port: wellknownPort,
             type: ROUTING_RULE_TYPES.GENERAL_PROXY,
             interfaceName: BLOCKLET_INTERFACE_WELLKNOWN,
+            did: site.blockletDid,
           },
           isProtected: true,
         });
@@ -391,7 +336,6 @@ const ensureWellknownRule = async (sites = []) => {
         grouped['/'] = [
           {
             id: '',
-            groupId: '',
             to: {
               did: site.blockletDid,
               componentId: site.blockletDid,
@@ -409,7 +353,6 @@ const ensureWellknownRule = async (sites = []) => {
       if (!site.rules.some((x) => x.from.pathPrefix === servicePathPrefix)) {
         site.rules.push({
           id: rule.id,
-          groupId: rule.groupId,
           from: {
             pathPrefix: servicePathPrefix,
             groupPathPrefix,
@@ -430,7 +373,6 @@ const ensureWellknownRule = async (sites = []) => {
       if (!site.rules.some((x) => x.from.pathPrefix === avatarPathPrefix)) {
         site.rules.push({
           id: rule.id,
-          groupId: rule.groupId,
           from: {
             pathPrefix: avatarPathPrefix,
             groupPathPrefix,
@@ -453,10 +395,8 @@ const ensureWellknownRule = async (sites = []) => {
   return sites;
 };
 
-const ensureBlockletDid = async (sites) => {
-  const info = await states.node.read();
-
-  return (sites || []).map((site) => {
+const ensureBlockletDid = (sites = [], info) => {
+  return sites.map((site) => {
     if (site.domain === DOMAIN_FOR_INTERNAL_SITE) {
       return site;
     }
@@ -472,39 +412,6 @@ const ensureBlockletDid = async (sites) => {
   });
 };
 
-const ensureCorsForWebWallet = async (sites) => {
-  const info = await states.node.read();
-  for (const site of sites) {
-    if (!isBasicSite(site.domain)) {
-      // Allow CORS from "Web Wallet"
-      addCorsToSite(site, info.webWalletUrl);
-    }
-  }
-  return sites;
-};
-
-/**
- * @description
- * @param {Array<any>} [sites=[]]
- * @param {Array<import('@blocklet/server-js').BlockletState>} blocklets
- * @return {Promise<any>}
- */
-const ensureCorsForDidSpace = (sites = [], blocklets) => {
-  return sites.map((site) => {
-    const blocklet = blocklets.find((x) => x.meta.did === site.blockletDid);
-    if (blocklet) {
-      const endpoint = blocklet.environments.find(
-        (x) => x.key === BLOCKLET_CONFIGURABLE_KEY.BLOCKLET_APP_BACKUP_ENDPOINT
-      );
-      if (endpoint && isUrl(endpoint.value)) {
-        addCorsToSite(site, endpoint.value);
-      }
-    }
-
-    return site;
-  });
-};
-
 const filterSitesForRemovedBlocklets = (sites = [], blocklets) => {
   return sites.filter((site) => {
     if (!site.domain.endsWith(BLOCKLET_SITE_GROUP_SUFFIX)) {
@@ -589,8 +496,6 @@ const ensureBlockletWellknownRules = (sites, blocklets) => {
     .filter(Boolean);
 };
 
-// Expand component rules to blocklet rules
-const isComponentRule = (x) => x.to.type === ROUTING_RULE_TYPES.COMPONENT;
 const expandComponentRules = (sites = [], blocklets) => {
   return sites
     .map((site) => {
@@ -603,50 +508,43 @@ const expandComponentRules = (sites = [], blocklets) => {
       }
 
       const blocklet = blocklets.find((x) => x.meta.did === site.blockletDid);
-      const components = blocklet.children.filter((x) => x.mountPoint !== '/' && x.mode === BLOCKLET_MODES.PRODUCTION);
-      const expandedRules = [];
-
-      site.rules.filter(isComponentRule).forEach((baseRule) => {
-        components.forEach((x) => {
-          if (!hasStartEngine(x.meta)) {
-            return;
-          }
-          const newRule = {
-            id: UUID.v4(),
-            groupId: baseRule.groupId,
-            from: {
-              groupPathPrefix: '/',
-            },
-            to: {
-              type: ROUTING_RULE_TYPES.BLOCKLET,
-              componentId: getComponentId(x, [blocklet]),
-              interfaceName: BLOCKLET_INTERFACE_PUBLIC,
-              port: findInterfacePortByName(x, BLOCKLET_INTERFACE_PUBLIC),
-              did: blocklet.meta.did,
-              target: '/',
-            },
-          };
-
-          if (x.meta.did === baseRule.to.componentId) {
-            newRule.from.pathPrefix = baseRule.from.pathPrefix;
-            newRule.to.pageGroup = baseRule.to.pageGroup;
-          } else {
-            newRule.from.pathPrefix = joinURL(baseRule.from.pathPrefix, x.mountPoint);
-          }
-
-          expandedRules.push(newRule);
-        });
+      const components = blocklet.children.filter((x) => x.mode === BLOCKLET_MODES.PRODUCTION);
+      const expandedRules = components
+        .filter((x) => hasMountPoint(x.meta))
+        .map((x) => ({
+          id: UUID.v4(),
+          from: {
+            pathPrefix: x.mountPoint,
+            groupPathPrefix: '/',
+          },
+          to: {
+            type: ROUTING_RULE_TYPES.BLOCKLET,
+            componentId: getComponentId(x, [blocklet]),
+            interfaceName: BLOCKLET_INTERFACE_PUBLIC,
+            port: findInterfacePortByName(x, BLOCKLET_INTERFACE_PUBLIC),
+            did: blocklet.meta.did,
+            target: '/',
+            pageGroup: '',
+          },
+        }));
+
+      // logger.info('expandComponentRules.before.rules', { siteId: site.id, rules: site.rules, expandedRules });
+      site.rules = site.rules.filter((x) => x.isProtected).concat(expandedRules);
+      site.rules.forEach((x) => {
+        if (x.to.type === ROUTING_RULE_TYPES.COMPONENT) {
+          x.to.type = ROUTING_RULE_TYPES.BLOCKLET;
+          x.to.componentId = [blocklet.meta.did, x.to.componentId].join('/');
+        }
       });
+      // logger.info('expandComponentRules.after.rules', { siteId: site.id, rules: site.rules });
 
-      site.rules = site.rules.filter((x) => !isComponentRule(x)).concat(expandedRules);
       site.componentExpanded = true;
-
       return site;
     })
     .filter(Boolean);
 };
 
-const ensureBlockletCache = (sites = [], blocklets) => {
+const ensureBlockletCache = (sites = [], blocklets = []) => {
   return sites
     .map((site) => {
       if (!site.domain.endsWith(BLOCKLET_SITE_GROUP_SUFFIX)) {
@@ -696,7 +594,7 @@ const ensureBlockletCache = (sites = [], blocklets) => {
     .filter(Boolean);
 };
 
-const ensureBlockletProxyBehavior = (sites, blocklets) => {
+const ensureBlockletProxyBehavior = (sites, blocklets = []) => {
   return sites
     .map((site) => {
       if (!site.domain.endsWith(BLOCKLET_SITE_GROUP_SUFFIX)) {
@@ -727,21 +625,130 @@ const ensureBlockletProxyBehavior = (sites, blocklets) => {
     .filter(Boolean);
 };
 
-const ensureLatestInfo = async (sites = [], { withDefaultCors = true } = {}) => {
-  const blocklets = await states.blocklet.getBlocklets();
+/**
+ * Get static root path for a component
+ * @param {object} component - Blocklet component
+ * @returns {string|null} - Absolute path to static files root, or null if not available
+ */
+const getStaticRoot = (component) => {
+  const appDir = component.environments.find((e) => e.key === 'BLOCKLET_APP_DIR')?.value;
+  if (!appDir) {
+    return null;
+  }
+
+  const main = component.meta?.main;
+  return main ? path.join(appDir, main) : appDir;
+};
+
+/**
+ * Check if a component can be served directly by Nginx
+ * Conditions:
+ * 1. Engine-based blocklet using 'blocklet' interpreter (static-server engine)
+ * 2. Engine source is the built-in static-server (not a custom engine)
+ * 3. Has a default security rule (pathPattern: '*') with ACCESS_POLICY_PUBLIC
+ *
+ * @param {object} component - Blocklet component
+ * @param {Array} securityRules - Security rules for the blocklet
+ * @returns {boolean} - True if can serve static directly
+ */
+const canServeStaticDirectly = (component, securityRules) => {
+  if (hasStartEngine(component.meta)) {
+    return false;
+  }
+
+  if (!securityRules || securityRules.length === 0) {
+    return false;
+  }
+
+  const componentRules = securityRules.filter((x) => x.componentDid === component.meta.did);
+  if (componentRules.length) {
+    return componentRules.every((x) => x.accessPolicy.id === ACCESS_POLICY_PUBLIC);
+  }
+
+  const fallbackRules = securityRules.filter((x) => !x.componentDid);
+  if (fallbackRules.length) {
+    return fallbackRules.every((x) => x.accessPolicy.id === ACCESS_POLICY_PUBLIC);
+  }
+
+  return false;
+};
+
+/**
+ * Ensure static serving info is added to routing rules for eligible blocklets
+ * This function adds serveStatic and staticRoot fields to rules that:
+ * 1. Are engine-based static blocklets
+ * 2. Have public access policy for all paths
+ *
+ * @param {Array} sites - Routing sites
+ * @param {Array} blocklets - All blocklets
+ * @param {object} teamManager - Team manager for querying security rules
+ * @returns {Promise<Array>} - Sites with static serving info added
+ */
+const ensureBlockletStaticServing = async (sites = [], blocklets = [], teamManager = null) => {
+  if (!teamManager) {
+    return sites;
+  }
+
+  const result = await Promise.all(
+    sites.map(async (site) => {
+      if (!site.domain.endsWith(BLOCKLET_SITE_GROUP_SUFFIX)) {
+        return site;
+      }
+
+      const blocklet = blocklets.find((x) => x.meta.did === site.blockletDid);
+      if (!blocklet) {
+        return site;
+      }
+
+      // Get security rules for this blocklet
+      const { securityRules } = await getBlockletSecurityRules(
+        { teamManager },
+        { did: blocklet.meta.did, formatted: true }
+      );
+
+      // Process each rule
+      site.rules
+        .filter((x) => x.to.type === ROUTING_RULE_TYPES.BLOCKLET && x.to.interfaceName === BLOCKLET_INTERFACE_PUBLIC)
+        .forEach((rule) => {
+          const component = findComponentById(blocklet, rule.to.componentId);
+          if (!component) {
+            return;
+          }
+
+          // Check if this component can be served directly
+          if (canServeStaticDirectly(component, securityRules)) {
+            const staticRoot = getStaticRoot(component);
+            logger.info('ensureBlockletStaticServing.canServeStaticDirectly', {
+              blockletDid: blocklet.meta.did,
+              componentDid: component.meta.did,
+              staticRoot,
+            });
+            if (staticRoot) {
+              rule.to.staticRoot = staticRoot;
+            }
+          }
+        });
+
+      return site;
+    })
+  );
+
+  return result.filter(Boolean);
+};
 
+const ensureLatestInfo = async (sites = [], blocklets = [], teamManager = null, { nodeInfo = null } = {}) => {
+  const info = nodeInfo ?? (await states.node.read());
   // CAUTION: following steps are very important, please do not change the order
-  let result = await ensureLatestNodeInfo(sites, { withDefaultCors });
-  result = await ensureBlockletDid(result);
-  result = await filterSitesForRemovedBlocklets(sites, blocklets);
-  result = await ensureBlockletProxyBehavior(result, blocklets);
-  result = await ensureBlockletCache(result, blocklets);
+  let result = ensureLatestNodeInfo(sites, info);
+  result = ensureBlockletDid(result, info);
+  result = filterSitesForRemovedBlocklets(result, blocklets);
+  result = ensureBlockletProxyBehavior(result, blocklets);
+  result = ensureBlockletCache(result, blocklets);
   result = await ensureWellknownRule(result);
-  result = await ensureCorsForWebWallet(result);
-  result = await ensureCorsForDidSpace(result, blocklets);
-  result = await ensureLatestInterfaceInfo(result);
-  result = await ensureBlockletWellknownRules(result, blocklets);
-  result = await expandComponentRules(result, blocklets);
+  result = await ensureLatestInterfaceInfo(result, blocklets);
+  result = ensureBlockletWellknownRules(result, blocklets);
+  result = expandComponentRules(result, blocklets);
+  result = await ensureBlockletStaticServing(result, blocklets, teamManager);
 
   return result;
 };
@@ -763,15 +770,17 @@ const getDownloadCertBaseUrl = (info) =>
 /**
  * 根据 DID 获取域名
  */
-const getDomainsByDid = async (did) => {
+const getDomainsByDid = async (did, teamManager) => {
   if (!did) {
     return [];
   }
 
   try {
     const sites = await states.site.getSitesByBlocklet(did);
+    const blocklet = await states.blocklet.getBlocklet(did);
+    const blocklets = blocklet ? [blocklet] : [];
     const domainAliases = await attachRuntimeDomainAliases({
-      sites: await ensureLatestInfo(sites, { withDefaultCors: false }),
+      sites: await ensureLatestInfo(sites, blocklets, teamManager),
       context: {},
     });
 
@@ -786,7 +795,6 @@ const getDomainsByDid = async (did) => {
 
 module.exports = function getRouterHelpers({
   dataDirs,
-  routingSnapshot,
   routerManager,
   blockletManager,
   certManager,
@@ -1049,6 +1057,7 @@ module.exports = function getRouterHelpers({
     const newSiteRule = {
       id: site.id,
       rule,
+      skipValidation: true, // Skip nginx validation for system rules - validated at end
     };
 
     const existingRule = findExistingRule(get(rule, 'from.pathPrefix'));
@@ -1067,9 +1076,13 @@ module.exports = function getRouterHelpers({
     return false;
   };
 
-  const addWellknownSite = async (sites, context) => {
-    const site = (sites || []).find((x) => x.name === NAME_FOR_WELLKNOWN_SITE);
-
+  /**
+   * Add wellknown site with routing rules
+   * @param {object|null} site - Pre-fetched wellknown site or null if not exists
+   * @param {object} context
+   * @returns {Promise<boolean>} - true if routing changed
+   */
+  const addWellknownSite = async (site, context) => {
     try {
       const info = await nodeState.read();
       const proxyTarget = {
@@ -1161,12 +1174,19 @@ module.exports = function getRouterHelpers({
    * Add system routing sites for the dashboard
    * Which should contain: default site, ip site, wellknown site
    *
+   * Optimized to use O(1) targeted queries instead of loading all sites.
+   * With thousands of blocklets, this avoids loading all sites into memory.
+   *
    * @returns {boolean} if routing changed
    */
   const ensureDashboardRouting = async (context = {}) => {
-    const info = await nodeState.read();
-    const sites = await siteState.getSites();
-    let dashboardSite = (sites || []).find((x) => x.domain === DOMAIN_FOR_IP_SITE);
+    // eslint-disable-next-line
+    let [info, dashboardSite, defaultSite, wellknownSite] = await Promise.all([
+      nodeState.read(),
+      siteState.findOne({ domain: DOMAIN_FOR_IP_SITE }),
+      siteState.findOne({ domain: DOMAIN_FOR_DEFAULT_SITE }),
+      siteState.findOne({ name: NAME_FOR_WELLKNOWN_SITE }),
+    ]);
     const updatedResult = [];
     if (!dashboardSite) {
       try {
@@ -1183,6 +1203,7 @@ module.exports = function getRouterHelpers({
               ],
             },
             skipCheckDynamicBlacklist: true,
+            skipValidation: true, // Skip nginx validation for system sites
           },
           context
         );
@@ -1221,8 +1242,7 @@ module.exports = function getRouterHelpers({
       logger.error('add dashboard analytics rule failed', { error });
     }
 
-    const defaultRule = sites.find((x) => x.domain === DOMAIN_FOR_DEFAULT_SITE);
-    if (!defaultRule) {
+    if (!defaultSite) {
       try {
         const result = await routerManager.addRoutingSite(
           {
@@ -1231,6 +1251,7 @@ module.exports = function getRouterHelpers({
               rules: [],
             },
             skipCheckDynamicBlacklist: true,
+            skipValidation: true, // Skip nginx validation for system sites
           },
           context
         );
@@ -1241,28 +1262,17 @@ module.exports = function getRouterHelpers({
       }
     }
 
-    const wellknownRes = await addWellknownSite(sites, context);
+    const wellknownRes = await addWellknownSite(wellknownSite, context);
     if (wellknownRes) {
       updatedResult.push(wellknownRes);
     }
 
-    if (updatedResult.length) {
-      // eslint-disable-next-line no-use-before-define
-      const hash = await takeRoutingSnapshot({ message: 'ensure dashboard routing rules', dryRun: false }, context);
-      logger.info('take routing snapshot on ensure dashboard routing rules', { updatedResult, hash });
-      return true;
-    }
-
-    return false;
+    return updatedResult.length > 0;
   };
 
-  async function updateSiteDomainAliases(existSite, blocklet, nodeInfo) {
+  async function updateSiteDomainAliases(site, blocklet, nodeInfo) {
     try {
-      /* 在有些 场景下, site 已经存在, 需要更新 DID Domain, 比如:
-       * - 恢复 Blocklet
-       */
-      // 因为更新路由是非常重要的操作，所以为了确保更新路由的稳定性，在更新域名时使用 try catch 来捕获异常
-      const domainAliases = cloneDeep(existSite.domainAliases || []);
+      const domainAliases = cloneDeep(site.domainAliases || []);
       const didDomainList = getBlockletDidDomainList(blocklet, nodeInfo);
       didDomainList.forEach((item) => {
         if (!domainAliases.some((alias) => alias.value === item.value)) {
@@ -1270,27 +1280,28 @@ module.exports = function getRouterHelpers({
         }
       });
 
-      if (isEqual(existSite.domainAliases, domainAliases)) {
-        logger.info('existing routing site domain aliases is up to date', {
-          existedDomainAliases: existSite.domainAliases,
+      // let didDomain in front of ipEchoDnsDomain
+      domainAliases.sort((a, b) => b.value.length - a.value.length);
+      if (isEqual(site.domainAliases, domainAliases)) {
+        logger.info('site domain aliases is up to date', {
+          siteId: site.id,
+          existedDomainAliases: site.domainAliases,
           domainAliases,
           didDomainList,
         });
       } else {
-        await states.site.updateDomainAliasList(existSite.id, domainAliases);
-        logger.info('update existing routing site domain aliases', { site: existSite, domainAliases, didDomainList });
+        await states.site.updateDomainAliasList(site.id, domainAliases);
+        logger.info('update site domain aliases', { site, domainAliases, didDomainList });
+        return true;
       }
     } catch (error) {
-      logger.error('update existing routing site domain aliases failed', { error, existSite });
+      logger.error('update site domain aliases failed', { error, site });
     }
+
+    return false;
   }
 
-  /**
-   * Add system sites for blocklet
-   *
-   * @returns {boolean} if routing state db changed
-   */
-  const _ensureBlockletSites = async (blocklet, nodeInfo, context = {}) => {
+  const _ensureBlockletRouting = async (blocklet, nodeInfo, context = {}) => {
     const webInterface = (blocklet.meta.interfaces || []).find((x) => x.type === BLOCKLET_INTERFACE_TYPE_WEB);
     if (!webInterface) {
       return false;
@@ -1304,36 +1315,21 @@ module.exports = function getRouterHelpers({
     };
 
     const domainGroup = getBlockletDomainGroupName(blocklet.meta.did);
-
-    const pathPrefix = getPrefix(webInterface.prefix);
     const rule = {
-      from: { pathPrefix },
+      from: { pathPrefix: getPrefix(webInterface.prefix) },
       to: {
         port: findInterfacePortByName(blocklet, webInterface.name),
         did: blocklet.meta.did,
         type: ROUTING_RULE_TYPES.BLOCKLET,
         interfaceName: webInterface.name, // root blocklet interface
       },
-      isProtected: true,
     };
 
     const existSite = await states.site.findOne({ domain: domainGroup });
-    updateBlockletDocument({
-      did: blocklet.appPid,
-      nodeInfo,
-      teamManager,
-      states,
-    })
-      .then(() => {
-        logger.info('updated blocklet dns document', {
-          did: blocklet.appPid,
-        });
-      })
-      .catch((err) => {
-        logger.error('update blocklet dns document failed', { did: blocklet.meta.did, error: err });
-      });
-
-    if (!existSite) {
+    if (existSite) {
+      await updateSiteDomainAliases(existSite, blocklet, nodeInfo);
+      logger.info('site already exists', { did: blocklet.meta.did, site: existSite });
+    } else {
       const domainAliases = getBlockletDidDomainList(blocklet, nodeInfo);
       // let didDomain in front of ipEchoDnsDomain
       domainAliases.push({ value: getIpDnsDomainForBlocklet(blocklet), isProtected: true });
@@ -1351,7 +1347,7 @@ module.exports = function getRouterHelpers({
       });
       rules.push(...rulesInPack);
 
-      await routerManager.addRoutingSite(
+      const created = await routerManager.addRoutingSite(
         {
           site: {
             domain: domainGroup,
@@ -1364,7 +1360,12 @@ module.exports = function getRouterHelpers({
         },
         context
       );
-      logger.info('add routing site', { site: domainGroup });
+      logger.info('create routing site for blocklet', {
+        did: blocklet.meta.did,
+        siteId: created.id,
+        rules,
+        domainAliases,
+      });
 
       const bindDomainCap = await states.blockletExtras.getSettings(blocklet.meta.did, 'bindDomainCap');
       const nftDid = await states.blockletExtras.getSettings(blocklet.meta.did, 'domainNftDid');
@@ -1436,35 +1437,35 @@ module.exports = function getRouterHelpers({
           chainHost: context.domainChainHost,
         });
       }
-
-      return true;
     }
 
-    logger.info('site already exists', { site: existSite });
-
-    await updateSiteDomainAliases(existSite, blocklet, nodeInfo);
+    updateBlockletDocument({
+      did: blocklet.meta.did,
+      nodeInfo,
+      teamManager,
+      states,
+    })
+      .then(() => {
+        logger.info('updated did document succeed on add blocklet', { did: blocklet.meta.did });
 
-    const existRule = (existSite.rules || []).find((y) => get(y, 'from.pathPrefix') === pathPrefix);
-    if (
-      existRule &&
-      (rule.to?.type !== ROUTING_RULE_TYPES.BLOCKLET || existRule.to?.type === ROUTING_RULE_TYPES.BLOCKLET)
-    ) {
-      await routerManager.updateRoutingRule({
-        id: existSite.id,
-        rule: {
-          ...rule,
-          id: existRule.id,
-        },
-        skipProtectedRuleChecking: true,
-      });
-      logger.info('update routing rule for site', { site: domainGroup });
-    } else {
-      await routerManager.addRoutingRule({
-        id: existSite.id,
-        rule,
+        // Trigger DNS lookup to warm up DNS cache (non-blocking)
+        // This helps reduce DNS resolution time when user accesses the blocklet after install
+        const domain = getDidDomainForBlocklet({
+          did: blocklet.meta.did,
+          didDomain: nodeInfo.didDomain || DEFAULT_DID_DOMAIN,
+        });
+        dns
+          .resolve(domain)
+          .then((result) => {
+            logger.info('dns cache warm-up completed', { did: blocklet.meta.did, domain, result });
+          })
+          .catch((error) => {
+            logger.warn('dns cache warm-up failed', { did: blocklet.meta.did, domain, error: error.message });
+          });
+      })
+      .catch((err) => {
+        logger.error('update did document failed on add blocklet', { did: blocklet.meta.did, error: err });
       });
-      logger.info('add routing rule for site', { site: domainGroup });
-    }
 
     return true;
   };
@@ -1513,12 +1514,7 @@ module.exports = function getRouterHelpers({
 
     try {
       const nodeInfo = await nodeState.read();
-      const hasWebInterface = (blocklet.meta.interfaces || []).some((x) => x.type === BLOCKLET_INTERFACE_TYPE_WEB);
-      if (!hasWebInterface) {
-        return false;
-      }
-
-      return await _ensureBlockletSites(blocklet, nodeInfo, context);
+      return await _ensureBlockletRouting(blocklet, nodeInfo, context);
     } finally {
       await ensureBlockletRoutingLock.releaseLock(lockName);
     }
@@ -1634,22 +1630,49 @@ module.exports = function getRouterHelpers({
     return ruleChanged || siteChanged;
   };
 
-  async function readRoutingSites(snapshotHash) {
-    let hash = snapshotHash;
-    if (!hash) {
-      logger.debug('router.readRoutingSites read snapshot hash from snapshot db');
-      hash = await routingSnapshot.getLastSnapshot();
-    }
+  async function readAllRoutingSites() {
+    const sites = await siteState.getSites();
+    const blocklets = await states.blocklet.getBlocklets();
+    return {
+      sites: await ensureLatestInfo(sites, blocklets, teamManager),
+    };
+  }
 
-    if (!hash) {
-      logger.error('Can not determine routing snapshot hash, there must be something wrong!');
-      return {};
+  /**
+   * Lightweight version of readAllRoutingSites for a single blocklet
+   * Only queries the specific blocklet's data from database
+   * @param {string} blockletDid - The blocklet DID
+   * @returns {Promise<Array>}
+   */
+  async function readBlockletRoutingSite(blockletDid) {
+    const [site, blocklet] = await Promise.all([
+      siteState.findOneByBlocklet(blockletDid),
+      states.blocklet.getBlocklet(blockletDid),
+    ]);
+
+    if (!site || !blocklet) {
+      logger.warn('readBlockletRoutingSite: site or blocklet not found', {
+        blockletDid,
+        hasSite: !!site,
+        hasBlocklet: !!blocklet,
+      });
+      return [];
     }
 
-    const result = await routingSnapshot.readSnapshot(hash);
-    result.sites = await ensureLatestInfo(result.sites);
+    return ensureLatestInfo([site], [blocklet], teamManager);
+  }
 
-    return result;
+  /**
+   * Lightweight version of readAllRoutingSites for system sites only (no blocklet sites)
+   * O(1) complexity - only queries system sites from database
+   * System sites: dashboard, wellknown, IP site, default site
+   * @returns {Promise<{sites: Array}>}
+   */
+  async function readSystemRoutingSites() {
+    // getSystemSites() returns sites where domain NOT LIKE '%@blocklet-site-group'
+    const systemSites = await siteState.getSystemSites();
+    const sites = await ensureLatestInfo(systemSites, [], teamManager);
+    return { sites };
   }
 
   async function resetSiteByDid(did, { refreshRouterProvider = true } = {}) {
@@ -1658,16 +1681,13 @@ module.exports = function getRouterHelpers({
     await ensureBlockletRouting(blocklet);
     if (refreshRouterProvider) {
       // eslint-disable-next-line no-use-before-define
-      const hash = await takeRoutingSnapshot({ message: `Reset blocklet ${did}`, dryRun: false });
-      logger.info('reset blocklet routing rules', { did, hash });
+      await handleBlockletRouting({ did, message: 'reset blocklet routing rules' });
     }
   }
 
-  const providers = {}; // we need to keep reference for different router instances
-
   const startAccessLogWatcher = (info) => {
     const providerName = get(info, 'routing.provider', null);
-    if (!providerName || !providers[providerName] || isInstanceWorker()) {
+    if (!providerName || !providers[providerName] || isWorkerInstance()) {
       return;
     }
 
@@ -1693,7 +1713,7 @@ module.exports = function getRouterHelpers({
 
   const startErrorLogWatcher = async (info, shouldScheduleReload = false) => {
     const providerName = get(info, 'routing.provider', null);
-    if (!providerName || !providers[providerName] || isInstanceWorker()) {
+    if (!providerName || !providers[providerName] || isWorkerInstance()) {
       return;
     }
 
@@ -1724,19 +1744,20 @@ module.exports = function getRouterHelpers({
         logger.debug('router error detected', { logEntries, grouped, blocked, timestamp: dayjs().unix() });
 
         if (blocked.length) {
-          providers[providerName].throttledReload();
-          // Reload 1 second after block expiration
+          // Queue global change to update blacklist in nginx config
+          providers[providerName].queueChange('global');
+          // Schedule reload after block expiration to remove IPs from blacklist
           uniq(blocked).forEach((timeout) => {
             setTimeout(() => {
               logger.info('router reload on block expire', { timeout, timestamp: dayjs().unix() });
-              providers[providerName].throttledReload();
+              providers[providerName].queueChange('global');
             }, timeout + 1000);
           });
         }
       });
     }
 
-    // Schedule router reload for active blacklist
+    // Schedule router reload for active blacklist expiration
     if (daemon && shouldScheduleReload) {
       const blacklist = await blocker.getActiveBlacklist(false);
       if (blacklist.length) {
@@ -1746,58 +1767,77 @@ module.exports = function getRouterHelpers({
           const timeout = x.expiresAt - now + 1;
           setTimeout(() => {
             logger.info('router reload on block expire', { ip: x.key });
-            providers[providerName].throttledReload();
+            providers[providerName].queueChange('global');
           }, timeout * 1000);
         });
       }
     }
   };
 
-  const handleRouting = async (nodeInfo) => {
-    const now = Date.now();
-    logger.info('start handle routing', {
-      snapshotHash: nodeInfo?.routing?.snapshotHash,
-    });
-    const providerName = get(nodeInfo, 'routing.provider', null);
+  const providers = {}; // we need to keep reference for different router instances
+  const providerInitPromises = {}; // track ongoing initializations for race condition handling
+
+  /**
+   * Ensure routing provider is initialized (idempotent, race-condition safe)
+   * Multiple concurrent calls will await the same initialization promise
+   * @returns {Promise<{ provider: Router, nodeInfo: object, providerName: string }>}
+   */
+  const ensureRoutingProvider = async () => {
+    const nodeInfo = await nodeState.read();
+    const providerName = get(nodeInfo, 'routing.provider');
     const httpsEnabled = get(nodeInfo, 'routing.https', true);
-    logger.debug('handle routing', { providerName, httpsEnabled });
 
-    const Provider = getProvider(providerName);
-    const checkResult = await Provider.check({ configDir: dataDirs.router });
-    if (!checkResult.available) {
-      throw new Error(`${providerName} pre-check failed, ${checkResult.error}`);
+    // Already initialized - fast path
+    if (providers[providerName]) {
+      return { provider: providers[providerName], nodeInfo, providerName };
     }
 
-    const shouldScheduleReload = !providers[providerName];
+    // Already initializing - await the same promise
+    if (providerInitPromises[providerName]) {
+      await providerInitPromises[providerName];
+      return { provider: providers[providerName], nodeInfo, providerName };
+    }
+
+    // Start initialization - store promise so concurrent calls can await it
+    providerInitPromises[providerName] = (async () => {
+      const startedAt = Date.now();
+      logger.info('ensureRoutingProvider: initializing', { providerName, httpsEnabled });
+
+      const Provider = getProvider(providerName);
+      const checkResult = await Provider.check({ configDir: dataDirs.router });
+      if (!checkResult.available) {
+        throw new Error(`routing provider ${providerName} pre-check failed, ${checkResult.error}`);
+      }
 
-    if (providers[providerName]) {
-      await providers[providerName].reload();
-    } else {
       providers[providerName] = new Router({
         provider: createProviderInstance({ nodeInfo, routerDataDir: dataDirs.router }),
-        getRoutingParams: async () => {
+        getAllRoutingParams: async () => {
           try {
-            const info = await nodeState._read();
-            logger.info('router:getRoutingParams read routing params', { snapshotHash: info.routing?.snapshotHash });
-
-            let { sites } = await readRoutingSites(info.routing?.snapshotHash);
-            sites = await ensureLatestInfo(sites);
-            sites = await ensureServiceRule(sites);
-            sites = await ensureRootRule(sites);
-
-            const certificates = httpsEnabled ? await certManager.getAllNormal() : [];
+            // Parallelize all independent async operations
+            const [info, { sites }, services, certificates, wafDisabledList] = await Promise.all([
+              nodeState._read(),
+              readAllRoutingSites(),
+              blockletState.getServices(),
+              httpsEnabled ? certManager.getAllNormal() : Promise.resolve([]),
+              states.blockletExtras.getWafDisabledBlocklets(),
+            ]);
+
+            // Fetch site info for WAF disabled blocklets in parallel
+            const wafDisabledBlocklets = await Promise.all(
+              wafDisabledList.map((x) =>
+                states.site.findOneByBlocklet(x.did).then((result) => ({ did: x.did, site: result }))
+              )
+            );
+
+            logger.info('router:getAllRoutingParams read routing params', { services });
 
             return {
-              sites,
+              sites: await ensureRootRule(sites),
               certificates,
               headers: get(nodeInfo, 'routing.headers', {}),
-              services: await blockletState.getServices(),
+              services,
               nodeInfo: info,
-              wafDisabledBlocklets: await Promise.all(
-                (await states.blockletExtras.getWafDisabledBlocklets()).map((x) =>
-                  states.site.findOneByBlocklet(x.did).then((result) => ({ did: x.did, site: result }))
-                )
-              ),
+              wafDisabledBlocklets,
             };
           } catch (err) {
             logger.error('Read routing rules failed', { error: err });
@@ -1812,8 +1852,98 @@ module.exports = function getRouterHelpers({
             return {};
           }
         },
+        // Lightweight getter for single blocklet updates - O(1) database queries
+        getBlockletRoutingParams: async (blockletDid) => {
+          try {
+            // Parallelize all independent async operations
+            const [info, sites, certificates] = await Promise.all([
+              nodeState._read(),
+              readBlockletRoutingSite(blockletDid),
+              httpsEnabled ? certManager.getAllNormal() : Promise.resolve([]),
+            ]);
+
+            if (!sites || sites.length === 0) {
+              logger.warn('router: getBlockletRoutingParams empty', { blockletDid });
+              return null;
+            }
+
+            logger.info('router: getBlockletRoutingParams success', { blockletDid, sites });
+
+            return {
+              sites,
+              certificates,
+              headers: get(info, 'routing.headers', {}),
+              nodeInfo: info,
+              wafDisabledBlocklets: [],
+            };
+          } catch (err) {
+            logger.error('router: getBlockletRoutingParams failed', { blockletDid, error: err });
+            return null;
+          }
+        },
+        // Lightweight getter for global/system routing params - O(1) database queries
+        // Returns only system sites (dashboard, wellknown, IP, default) + services + global policies
+        getSystemRoutingParams: async () => {
+          try {
+            // Parallelize all independent async operations
+            const [info, { sites }, services, certificates, wafDisabledList] = await Promise.all([
+              nodeState._read(),
+              readSystemRoutingSites(),
+              blockletState.getServices(),
+              httpsEnabled ? certManager.getAllNormal() : Promise.resolve([]),
+              states.blockletExtras.getWafDisabledBlocklets(),
+            ]);
+
+            // Fetch site info for WAF disabled blocklets in parallel
+            const wafDisabledBlocklets = await Promise.all(
+              wafDisabledList.map((x) =>
+                states.site.findOneByBlocklet(x.did).then((result) => ({ did: x.did, site: result }))
+              )
+            );
+
+            logger.info('router: getSystemRoutingParams success', {
+              services,
+              wafDisabledBlocklets,
+              sites,
+            });
+
+            return {
+              sites,
+              certificates,
+              services,
+              headers: get(info, 'routing.headers', {}),
+              nodeInfo: info,
+              wafDisabledBlocklets,
+            };
+          } catch (err) {
+            logger.error('router: getSystemRoutingParams failed', { error: err });
+            return null;
+          }
+        },
       });
 
+      // Helper to find affected blocklets by certificate
+      const findAffectedBlockletsByCert = async (cert) => {
+        if (!cert) return [];
+
+        const sites = await siteState.getSites();
+        const affectedDids = new Set();
+
+        for (const site of sites) {
+          if (!site.domain.endsWith(BLOCKLET_SITE_GROUP_SUFFIX)) continue;
+
+          const domains = [site.domain, ...(site.domainAliases || []).map((x) => x.value)];
+          const isMatch = domains.some((domain) => domain && routerManager.isCertMatchedDomain(cert, domain));
+
+          if (isMatch) {
+            affectedDids.add(site.domain.replace(BLOCKLET_SITE_GROUP_SUFFIX, ''));
+          }
+        }
+
+        return Array.from(affectedDids);
+      };
+
+      // Set up cert event handlers - trigger targeted routing updates
       [
         BlockletEvents.certIssued,
         EVENTS.CERT_ADDED,
@@ -1821,16 +1951,85 @@ module.exports = function getRouterHelpers({
         EVENTS.CERT_ISSUED,
         EVENTS.CERT_UPDATED,
       ].forEach((event) => {
-        certManager.on(event, () => providers[providerName].reload());
+        certManager.on(event, async (cert) => {
+          if (!cert) return;
+
+          logger.info('cert event triggered routing update', { event, domain: cert.domain });
+
+          // Always update global routing for cert changes
+          // eslint-disable-next-line no-use-before-define
+          await handleSystemRouting({ message: `cert event: ${event}` });
+
+          // Find and update affected blocklets
+          const affectedDids = await findAffectedBlockletsByCert(cert);
+          for (const did of affectedDids) {
+            // eslint-disable-next-line no-await-in-loop, no-use-before-define
+            await handleBlockletRouting({ did, message: `cert event: ${event}` });
+          }
+        });
       });
 
-      await providers[providerName].start();
+      await startAccessLogWatcher(nodeInfo);
+      await startErrorLogWatcher(nodeInfo, true);
+
+      logger.info('ensureRoutingProvider: initialized', { providerName, duration: Date.now() - startedAt });
+    })();
+
+    try {
+      await providerInitPromises[providerName];
+    } finally {
+      // Clean up promise regardless of success/failure
+      delete providerInitPromises[providerName];
     }
 
-    await startAccessLogWatcher(nodeInfo);
-    await startErrorLogWatcher(nodeInfo, shouldScheduleReload);
+    return { provider: providers[providerName], nodeInfo, providerName };
+  };
 
-    logger.info('done handle routing', { cost: Date.now() - now });
+  /**
+   * Lightweight handler for global/system routing updates - O(1) complexity
+   * Use this for changes that only affect global config (policies, system sites, services)
+   * @param {Object} options
+   * @param {string} [options.message] - Log message describing the change
+   */
+  const handleSystemRouting = async ({ message = '' } = {}) => {
+    logger.info('handleSystemRouting: triggered', { message });
+    const { provider, providerName } = await ensureRoutingProvider();
+    provider.queueChange('global');
+    logger.info('handleSystemRouting: queued', { message, providerName });
+  };
+
+  /**
+   * Lightweight handler for single blocklet routing updates - O(2) complexity
+   * Updates blocklet config + global config (for services that may have changed)
+   * @param {Object} options
+   * @param {string} options.did - Blocklet DID
+   * @param {string} [options.message] - Log message describing the change
+   * @param {boolean} [options.isRemoval] - Whether this is a blocklet removal
+   */
+  const handleBlockletRouting = async ({ did, message = '', isRemoval = false }) => {
+    logger.info('handleBlockletRouting: triggered', { did, message, isRemoval });
+    if (!did) {
+      return;
+    }
+
+    const { provider, providerName } = await ensureRoutingProvider();
+    const changeType = isRemoval ? 'blocklet-remove' : 'blocklet';
+    provider.queueChange('global');
+    provider.queueChange(changeType, did);
+    logger.info('handleBlockletRouting: queued', { did, message, isRemoval, providerName });
+  };
+
+  /**
+   * Full regeneration handler - O(N) complexity
+   * Use this for startup, manual rebuild, or when complete regeneration is needed
+   * @param {Object} options
+   * @param {string} [options.message] - Log message describing the change
+   */
+  const handleAllRouting = async ({ message = '' } = {}) => {
+    logger.info('handleAllRouting: triggered', { message });
+    const { provider, providerName } = await ensureRoutingProvider();
+    await provider.regenerateAll({ message });
+    logger.info('handleAllRouting: done', { message, providerName });
   };
 
   const rotateRouterLog = async () => {
@@ -1846,8 +2045,6 @@ module.exports = function getRouterHelpers({
 
   const analyzeRouterLog = async () => {
     const info = await nodeState.read();
-    // eslint-disable-next-line no-use-before-define
-    const sites = await getRoutingSites({});
     const providerName = get(info, 'routing.provider', null);
     if (!providerName || !providers[providerName]) {
       logger.warn('No router provider instance found');
@@ -1855,6 +2052,8 @@ module.exports = function getRouterHelpers({
     }
 
     const groups = [];
+    const sites = await attachRuntimeDomainAliases({ sites: await siteState.getSites(), context: {} });
+
     const server = sites.find((x) =>
       x.rules.some((rule) => rule.to.type === ROUTING_RULE_TYPES.DAEMON && rule.to.did === info.did)
     );
@@ -1935,124 +2134,10 @@ module.exports = function getRouterHelpers({
     logger.info('refresh gateway blacklist from cron', { hash, blacklist });
   };
 
-  const updateNodeRouting = async (params, context = {}) => {
-    const info = await nodeState.read();
-    const { snapshotHash: oldSnapshotHash } = info.routing || {};
-    const { snapshotHash: newSnapshotHash, forceRepopulate = false } = params;
-
-    // Repopulate routing rules if we have changed the routing snapshot
-    const isValidSnapshot = newSnapshotHash ? await routingSnapshot.hasSnapshot(newSnapshotHash) : false;
-    if (isValidSnapshot) {
-      if (!oldSnapshotHash || oldSnapshotHash !== newSnapshotHash || forceRepopulate) {
-        const { sites, meta } = await routingSnapshot.readSnapshot(newSnapshotHash);
-        const result = await routerManager.repopulateRouting({ sites });
-        await routingSnapshot.restoreMetaData(meta);
-        logger.info(`repopulate routing rules from snapshot: ${newSnapshotHash}`, { result });
-      }
-    }
-
-    const newProvider = params.provider || getProviderFromNodeInfo(info);
-    const result = await nodeState.updateNodeRouting({
-      ...info.routing,
-      snapshotHash: newSnapshotHash || oldSnapshotHash || '',
-      provider: newProvider,
-    });
-    await handleRouting(result);
-
-    if (newProvider !== info.routing.provider) {
-      // Ensure we have system sites for daemon
-      await ensureDashboardRouting(context);
-
-      // Ensure we have system rules for blocklets
-      const blocklets = await blockletState.getBlocklets();
-      const ensureBlocklet = async (x) => {
-        const blocklet = await blockletManager.getBlocklet(x.meta.did);
-        return ensureBlockletRouting(blocklet, context);
-      };
-      const ensureBlockletResults = await Promise.all(blocklets.map((x) => ensureBlocklet(x)));
-
-      // We need to take snapshot after system rules ensured
-      if (ensureBlockletResults.filter(Boolean).length) {
-        // eslint-disable-next-line no-use-before-define
-        await takeRoutingSnapshot({ message: `Switch routing engine to ${newProvider}`, dryRun: false }, context);
-        logger.info(`take routing snapshot on switch engine: ${newProvider}`, { ensureBlockletResults });
-      }
-
-      const Provider = getProvider(info.routing.provider);
-      if (Provider) {
-        try {
-          const providerInstance = createProviderInstance({
-            nodeInfo: info,
-            routerDataDir: dataDirs.router,
-          });
-
-          await providerInstance.stop();
-          logger.info('original router stopped:', { provider: info.routing.provider });
-        } catch (err) {
-          logger.error('original router stop failed:', { provider: info.routing.provider, error: err });
-        }
-      }
-    }
-
-    return result;
-  };
-
-  /**
-   * @param {string} message
-   * @param {boolean} dryRun
-   * @param {boolean} handleRouting if NOT dryRun and handleRouting is true, will run handleRouting() after update routing
-   * @returns
-   */
-  // eslint-disable-next-line no-unused-vars
-  const takeRoutingSnapshot = async ({ message, dryRun = true, handleRouting: handle = true }, context = {}) => {
-    const msg = decodeURIComponent(message);
-
-    if (!msg) {
-      throw new Error('Please provide a message for this snapshot');
-    }
-    if (!dryRun) {
-      if (msg.length < 5) {
-        throw new Error('Message cannot be less than 5 characters');
-      }
-      if (msg.length > 150) {
-        throw new Error('Message cannot exceed 100 characters');
-      }
-    }
-
-    const hash = await routingSnapshot.takeSnapshot(msg, dryRun);
-    if (!dryRun) {
-      let nodeInfo = await nodeState.read();
-      nodeInfo = await nodeState.updateNodeRouting({ ...nodeInfo.routing, snapshotHash: hash });
-      if (handle) {
-        await handleRouting(nodeInfo);
-      }
-      logger.info('takeRoutingSnapshot', {
-        dryRun,
-        handleRouting: handle,
-        hash,
-        dbSnapshotHash: nodeInfo?.routing?.snapshotHash,
-      });
-    }
-
-    return hash;
-  };
-
-  const getSitesFromSnapshot = async ({ snapshotHash } = {}) => {
-    const latestSnapshot = await routingSnapshot.getLastSnapshot(true);
-    if (!snapshotHash || snapshotHash === latestSnapshot) {
-      const sites = await siteState.getSites();
-      return ensureLatestInfo(sites);
-    }
-
-    const isValidSnapshot = await routingSnapshot.hasSnapshot(snapshotHash);
-    if (!isValidSnapshot) {
-      const sites = await siteState.getSites();
-      return ensureLatestInfo(sites);
-    }
-
-    const { sites = [] } = await routingSnapshot.readSnapshot(snapshotHash);
-
-    return ensureLatestInfo(sites);
+  const getSitesFromState = async (scope = 'all') => {
+    const sites = scope === 'all' ? await siteState.getSites() : await siteState.getSystemSites();
+    const blocklets = scope === 'all' ? await states.blocklet.getBlocklets() : [];
+    return ensureLatestInfo(sites, blocklets, teamManager);
   };
 
   /**
@@ -2061,30 +2146,22 @@ module.exports = function getRouterHelpers({
    * @param {*} context
    * @param {string} withInterfaceUrls
    */
-  const getRoutingSites = async (params, context = {}, { withInterfaceUrls = true, withDefaultCors = true } = {}) => {
-    const sites = await getSitesFromSnapshot();
+  const getRoutingSites = async (params, context = {}, { withInterfaceUrls = true, scope = 'all' } = {}) => {
+    const sites = await getSitesFromState(scope);
 
     if (!withInterfaceUrls) {
       return sites;
     }
 
     return attachRuntimeDomainAliases({
-      sites: await ensureLatestInfo(sites, { withDefaultCors }),
-      context,
-    });
-  };
-
-  const getSnapshotSites = async ({ hash }, context = {}, { withDefaultCors = true } = {}) => {
-    const sites = await routingSnapshot.readSnapshotSites(hash);
-    return attachRuntimeDomainAliases({
-      sites: await ensureLatestInfo(sites, { withDefaultCors }),
+      sites,
       context,
     });
   };
 
   const getCertificates = async () => {
     const certificates = await certManager.getAll();
-    const sites = await getSitesFromSnapshot();
+    const sites = await attachRuntimeDomainAliases({ sites: await siteState.getSites(), context: {} });
 
     const isMatch = (cert, domain) =>
       domain !== DOMAIN_FOR_DEFAULT_SITE && domain && routerManager.isCertMatchedDomain(cert, domain);
@@ -2105,18 +2182,14 @@ module.exports = function getRouterHelpers({
   };
 
   /**
-   * proxy to routerManager and do takeRoutingSnapshot
+   * proxy to routerManager and trigger handleBlockletRouting after operation
    */
   const _proxyToRouterManager =
     (fnName) =>
     async (...args) => {
       const res = await routerManager[fnName](...args);
-
-      takeRoutingSnapshot({ message: fnName, dryRun: false }).catch((error) => {
-        logger.error('failed to takeRoutingSnapshot', { error });
-      });
-
       const { teamDid: did } = args[0] || {};
+      await handleBlockletRouting({ did, message: fnName });
       if (did) {
         routerManager.emit(BlockletEvents.updated, { meta: { did } });
       }
@@ -2182,13 +2255,12 @@ module.exports = function getRouterHelpers({
     ensureBlockletRouting,
     ensureBlockletRoutingForUpgrade,
     removeBlockletRouting,
-    handleRouting,
+    handleSystemRouting, // O(1) - for global config changes only
+    handleBlockletRouting, // O(2) - for single blocklet + global (services)
+    handleAllRouting, // O(N) - for full regeneration
     resetSiteByDid,
-    updateNodeRouting,
-    takeRoutingSnapshot,
     getRoutingSites,
-    getSnapshotSites,
-    getSitesFromSnapshot,
+    getSitesFromState,
     getCertificates,
     ensureWildcardCerts,
     ensureServerlessCerts,
@@ -2267,6 +2339,7 @@ module.exports.ensureLatestInfo = ensureLatestInfo;
 module.exports.ensureWellknownRule = ensureWellknownRule;
 module.exports.ensureBlockletWellknownRules = ensureBlockletWellknownRules;
 module.exports.ensureBlockletProxyBehavior = ensureBlockletProxyBehavior;
+module.exports.ensureBlockletStaticServing = ensureBlockletStaticServing;
 module.exports.expandComponentRules = expandComponentRules;
 module.exports.getDomainsByDid = getDomainsByDid;
 module.exports.ensureBlockletHasMultipleInterfaces = ensureBlockletHasMultipleInterfaces;