1
0

6 Commity 380aff4d82 ... c8a3a2d723

Autor SHA1 Správa Dátum
  Sanaei c8a3a2d723 fix(security): require a 2FA code to replace the stored TOTP secret 1 deň pred
  Sanaei b51f09768b fix(netsafe): classify IPv6 transition and CGNAT ranges as internal 1 deň pred
  Sanaei 3c087f6fd9 chore(docs): update dependencies and adapt to zbsearch 4 1 deň pred
  Sanaei ce63bf3e66 fix(frontend): restore the two rolldown bindings npm dropped from the lockfile 1 deň pred
  Sanaei b9eda09da9 chore(frontend): update dependencies and adapt to oxlint 1.79 1 deň pred
  Sanaei 92fb94d856 Move to TypeScript 7 and the oxc toolchain (oxlint + oxfmt) (#6262) 1 deň pred
100 zmenil súbory, kde vykonal 3443 pridanie a 3185 odobranie
  1. 5 0
      .github/workflows/ci.yml
  2. 3 0
      .github/workflows/docs-ci.yml
  3. 3 2
      CLAUDE.md
  4. 5 4
      CONTRIBUTING.md
  5. 8 4
      Makefile
  6. 21 0
      docs/.oxfmtrc.json
  7. 42 0
      docs/.oxlintrc.json
  8. 0 10
      docs/.prettierignore
  9. 0 7
      docs/.prettierrc.json
  10. 3 3
      docs/CONTRIBUTING.md
  11. 16 16
      docs/README.md
  12. 2 7
      docs/app/api/search/route.ts
  13. 101 95
      docs/architecture.md
  14. 4 8
      docs/components/search-dialog.tsx
  15. 6 1
      docs/components/tools/api-request-builder.tsx
  16. 72 11
      docs/components/tools/routing-builder.tsx
  17. 38 7
      docs/components/tools/subscription-builder.tsx
  18. 16 30
      docs/content/docs/en/reference/api/authentication.mdx
  19. 4 8
      docs/content/docs/en/reference/api/backup.mdx
  20. 195 346
      docs/content/docs/en/reference/api/clients.mdx
  21. 19 36
      docs/content/docs/en/reference/api/hosts.mdx
  22. 124 232
      docs/content/docs/en/reference/api/server.mdx
  23. 37 70
      docs/content/docs/en/reference/api/settings.mdx
  24. 23 36
      docs/content/docs/en/reference/api/subscription-server.mdx
  25. 5 10
      docs/content/docs/en/reference/api/websocket.mdx
  26. 84 160
      docs/content/docs/en/reference/api/xray-settings.mdx
  27. 22 22
      docs/custom-subscription-templates.md
  28. 0 21
      docs/eslint.config.mjs
  29. 8 1
      docs/lib/layout.shared.tsx
  30. 2 1
      docs/lib/site-i18n.ts
  31. 20 6
      docs/lib/xray/api-client.test.ts
  32. 6 1
      docs/lib/xray/outbounds.test.ts
  33. 5 1
      docs/lib/xray/outbounds.ts
  34. 6 1
      docs/lib/xray/routing.test.ts
  35. 4 1
      docs/lib/xray/routing.ts
  36. 10 2
      docs/lib/xray/subscription.ts
  37. 12 5
      docs/lib/xray/telegram.test.ts
  38. 4 1
      docs/lib/xray/telegram.ts
  39. 16 19
      docs/package.json
  40. 417 470
      docs/pnpm-lock.yaml
  41. 4 5
      docs/pnpm-workspace.yaml
  42. 10 10
      docs/real-client-ip.md
  43. 14 0
      frontend/.oxfmtrc.json
  44. 72 0
      frontend/.oxlintrc.json
  45. 1 1
      frontend/CLAUDE.md
  46. 18 11
      frontend/README.md
  47. 0 89
      frontend/eslint.config.js
  48. 0 26
      frontend/eslint.deprecated.config.js
  49. 611 941
      frontend/package-lock.json
  50. 25 24
      frontend/package.json
  51. 3 1
      frontend/src/api/http-init.ts
  52. 26 10
      frontend/src/api/queries/useAllSettings.ts
  53. 3 1
      frontend/src/api/queries/useFactoryDefaults.ts
  54. 3 1
      frontend/src/api/queries/useFail2banStatusQuery.ts
  55. 11 2
      frontend/src/api/queries/useGeodata.ts
  56. 31 12
      frontend/src/api/queries/useHostMutations.ts
  57. 29 14
      frontend/src/api/queries/useNodeMutations.ts
  58. 6 2
      frontend/src/api/queries/useOutboundTags.ts
  59. 3 1
      frontend/src/api/queries/useStatusQuery.ts
  60. 2 1
      frontend/src/api/queryKeys.ts
  61. 15 4
      frontend/src/api/websocket.ts
  62. 5 2
      frontend/src/components/clients/ClientCardComment.tsx
  63. 1 2
      frontend/src/components/clients/ClientSpeedTag.tsx
  64. 4 1
      frontend/src/components/clients/ClientTrafficCell.stories.tsx
  65. 8 2
      frontend/src/components/clients/ClientTrafficCell.tsx
  66. 17 5
      frontend/src/components/clients/ConfigBlock.stories.tsx
  67. 12 6
      frontend/src/components/clients/ConfigBlock.tsx
  68. 3 1
      frontend/src/components/feedback/PromptModal.stories.tsx
  69. 19 9
      frontend/src/components/feedback/PromptModal.tsx
  70. 7 2
      frontend/src/components/feedback/TextModal.stories.tsx
  71. 53 38
      frontend/src/components/feedback/TextModal.tsx
  72. 2 2
      frontend/src/components/form/DateTimePicker.css
  73. 3 1
      frontend/src/components/form/DateTimePicker.stories.tsx
  74. 4 1
      frontend/src/components/form/DateTimePicker.tsx
  75. 19 4
      frontend/src/components/form/HeaderMapEditor.stories.tsx
  76. 10 6
      frontend/src/components/form/HeaderMapEditor.tsx
  77. 3 2
      frontend/src/components/form/JsonEditor.tsx
  78. 12 2
      frontend/src/components/form/RemarkTemplateField.stories.tsx
  79. 25 4
      frontend/src/components/form/RemarkTemplateField.tsx
  80. 7 2
      frontend/src/components/form/RemarkVarPicker.stories.tsx
  81. 37 22
      frontend/src/components/form/RemarkVarPicker.tsx
  82. 16 4
      frontend/src/components/form/SelectAllClearButtons.stories.tsx
  83. 1 5
      frontend/src/components/form/SelectAllClearButtons.tsx
  84. 23 6
      frontend/src/components/form/rhf/FormField.stories.tsx
  85. 3 1
      frontend/src/components/form/rhf/useZodForm.ts
  86. 515 108
      frontend/src/components/geodata/GeoBrowserModal.stories.tsx
  87. 107 47
      frontend/src/components/geodata/GeoBrowserModal.tsx
  88. 70 21
      frontend/src/components/geodata/GeoTokenInput.stories.tsx
  89. 39 25
      frontend/src/components/geodata/GeoTokenInput.tsx
  90. 4 1
      frontend/src/components/ui/DefaultSettingTag.tsx
  91. 10 1
      frontend/src/components/ui/InputAddon.tsx
  92. 14 4
      frontend/src/components/ui/SettingListItem.tsx
  93. 8 3
      frontend/src/components/ui/notifications/EmailNotifications.stories.tsx
  94. 43 14
      frontend/src/components/ui/notifications/EmailNotifications.tsx
  95. 5 1
      frontend/src/components/ui/notifications/NotificationCard.tsx
  96. 1 5
      frontend/src/components/ui/notifications/NotificationEvent.tsx
  97. 36 7
      frontend/src/components/ui/notifications/NotificationGroup.stories.tsx
  98. 10 2
      frontend/src/components/ui/notifications/NotificationGroup.tsx
  99. 3 1
      frontend/src/components/ui/notifications/NotificationHeader.stories.tsx
  100. 29 4
      frontend/src/components/ui/notifications/NotificationHeader.tsx

+ 5 - 0
.github/workflows/ci.yml

@@ -8,6 +8,7 @@ on:
       - "go.sum"
       - "frontend/**"
       - ".nvmrc"
+      - "Makefile"
       - ".github/workflows/ci.yml"
   push:
     branches:
@@ -18,6 +19,7 @@ on:
       - "go.sum"
       - "frontend/**"
       - ".nvmrc"
+      - "Makefile"
       - ".github/workflows/ci.yml"
 
 permissions:
@@ -188,6 +190,9 @@ jobs:
       - name: Lint
         run: npm run lint
         working-directory: frontend
+      - name: Format check
+        run: npm run format:check
+        working-directory: frontend
       - name: Typecheck
         run: npm run typecheck
         working-directory: frontend

+ 3 - 0
.github/workflows/docs-ci.yml

@@ -42,6 +42,9 @@ jobs:
       - name: Lint
         run: pnpm lint
 
+      - name: Format check
+        run: pnpm format:check
+
       - name: Test
         run: pnpm test
 

+ 3 - 2
CLAUDE.md

@@ -125,7 +125,7 @@ file locations when it can answer in one hop.
 
 ## Frontend conventions (summary; full version in frontend/CLAUDE.md)
 - Ant Design 6 only — no Tailwind/shadcn. Targeted tweaks, not rewrites.
-- TS strict; `@typescript-eslint/no-explicit-any` is an error. Zod schemas in
+- TS strict; oxlint's `typescript/no-explicit-any` is an error. Zod schemas in
   `src/schemas/` are the source of truth; infer types with `z.infer`, never
   hand-write. Do not edit `src/generated/`.
 - Node 24 (`.nvmrc`) — `make gen` imports `.ts` directly and needs its type
@@ -147,7 +147,8 @@ reads as a broken repo, not a missing step. Run `make dist-stub` once; every
 `make` Go target already depends on it, which is why `make test-go` beats
 `go test ./...`. Run `make help` for all targets. The local gate:
 
-    make verify   # gen-check + lint + typecheck + test + build + build-storybook
+    make verify   # gen-check + lint + format-check + typecheck + test + build
+                  # + build-storybook
 
 That is the *fast* gate, not all of CI. `ci.yml` also runs `make race`,
 `make vulncheck`, a live-Postgres job (where a SKIP counts as a failure) and a

+ 5 - 4
CONTRIBUTING.md

@@ -186,7 +186,7 @@ Only a genuinely **standalone bundle** (like `login` or `subpage`, reachable wit
 - **Function components + hooks** everywhere. No class components.
 - **Comments in committed Go/TS/TSX: 2 lines MAX per comment block**, spent on the *why* a name cannot hold — an invariant, an issue number, a non-obvious constraint. Names should carry the meaning; rename rather than annotate. Compiler and tool directives (`//go:build`, `//go:generate`, `//nolint:`) are exempt, and HTML `<!-- ... -->` is fine for template structure.
 - **Persian and Arabic users are first-class.** When writing Persian text in toasts or labels, isolate code identifiers on their own lines so RTL reading flows. (Full RTL layout is not currently wired through AntD `ConfigProvider direction` — only the Jalali date picker is RTL-aware — so treat RTL as an open area, not a solved one.)
-- **Schemas over `any`.** New config shapes go in `src/schemas/`; `@typescript-eslint/no-explicit-any` is an error and production schemas use no `.loose()`. Validate form fields with `antdRule(Schema.shape.field, t)` rather than inline `z.string()` in rules.
+- **Schemas over `any`.** New config shapes go in `src/schemas/`; oxlint's `typescript/no-explicit-any` is an error and production schemas use no `.loose()`. Validate form fields with `antdRule(Schema.shape.field, t)` rather than inline `z.string()` in rules.
 - **Document new endpoints.** Every new `g.POST`/`g.GET` in `internal/web/controller/` needs a matching entry in `src/pages/api-docs/endpoints.ts` — it drives both the in-panel API docs and the generated OpenAPI/Zod (`npm run gen:api` / `gen:zod`).
 - **Do not break link generation.** Share-link logic lives in `src/lib/xray/` (`inbound-link.ts`, `outbound-link-parser.ts`, …) and is round-tripped by the golden fixture suite — run `npm run test` after any change to URL generation, defaults, or TLS/Reality handling, and regenerate snapshots (`npx vitest run -u`) only for intentional changes. Two runtime paths consume it: the **inbounds page** and the **clients page** subscription links (`/panel/api/clients/subLinks/:subId` → backend `GetSubs`); exercise both.
 - **Vite is pinned to an exact version** (no `^`) in `frontend/package.json` — read the live version there rather than trusting a number quoted here — so local, CI, and release builds resolve identically. Bump it deliberately and verify both `npm run dev` and `npm run build` afterward.
@@ -200,7 +200,8 @@ frontend/
 ├── login.html             — login + 2FA entry
 ├── subpage.html           — public subscription viewer entry
 ├── tsconfig.json          — strict, jsx: "react-jsx", paths "@/*" → "src/*"
-├── eslint.config.js       — ESLint flat config (@eslint/js + typescript-eslint + react-hooks)
+├── .oxlintrc.json         — oxlint config (typescript + react-hooks + jsx-a11y)
+├── tools/oxlint/          — input-number-guard.mjs (#6121/#6127 guard as a JS plugin)
 ├── vite.config.js
 ├── vitest.config.ts
 ├── scripts/               — build-openapi.mjs (endpoints.ts → openapi.json)
@@ -279,7 +280,7 @@ CI runs this for you nightly (and on demand) via `.github/workflows/mutation.yml
 
 ### CI
 
-`.github/workflows/ci.yml` runs per PR: `go-test` (with `-shuffle -count=1`), a `race` job (`-race -shuffle -count=1`), a `fuzz-smoke` job on the critical parsers, and the frontend `typecheck`/`lint`/`test`/`build`/`build-storybook`. Snapshots are regression guards — regenerate them (`npx vitest run -u`) only for intentional output changes, never to make a red test green.
+`.github/workflows/ci.yml` runs per PR: `go-test` (with `-shuffle -count=1`), a `race` job (`-race -shuffle -count=1`), a `fuzz-smoke` job on the critical parsers, and the frontend `typecheck`/`lint`/`format:check`/`test`/`build`/`build-storybook`. Snapshots are regression guards — regenerate them (`npx vitest run -u`) only for intentional output changes, never to make a red test green.
 
 ## Sending a pull request
 
@@ -288,7 +289,7 @@ CI runs this for you nightly (and on demand) via `.github/workflows/mutation.yml
 3. Run the relevant checks before pushing:
    - `go build ./...`
    - `go test ./...` (when Go code changed)
-   - `cd frontend && npm run typecheck && npm run lint && npm run test && npm run build && npm run build-storybook` (when the frontend changed; CI runs this same set on every PR via `.github/workflows/ci.yml`)
+   - `cd frontend && npm run typecheck && npm run lint && npm run format:check && npm run test && npm run build && npm run build-storybook` (when the frontend changed; CI runs this same set on every PR via `.github/workflows/ci.yml`)
 4. Commit messages follow the existing pattern in `git log` — `<area>: short imperative summary`, then a body explaining the *why*. Conventional-commit prefixes (`feat`, `fix`, `refactor`, `chore`, `style`, `docs`) are encouraged.
 5. Open the PR against `main` with a brief description of what changed and how to test it.
 

+ 8 - 4
Makefile

@@ -31,12 +31,16 @@ lint-go: dist-stub ## golangci-lint on Go sources
 	golangci-lint run
 
 .PHONY: lint-fe
-lint-fe: ## ESLint on frontend sources
+lint-fe: ## oxlint on frontend sources
 	cd $(FRONTEND) && npm run lint
 
 .PHONY: lint
 lint: lint-go lint-fe ## All linters
 
+.PHONY: format-check
+format-check: ## oxfmt in check mode on frontend sources
+	cd $(FRONTEND) && npm run format:check
+
 .PHONY: typecheck
 typecheck: ## tsc --noEmit
 	cd $(FRONTEND) && npm run typecheck
@@ -76,8 +80,8 @@ build: build-fe ## Build the frontend then the Go binary
 build-storybook: ## Build the static Storybook (compile-checks all stories)
 	cd $(FRONTEND) && npm run build-storybook
 
-# The PR gate. Matches ci.yml: codegen freshness, both linters, typecheck,
-# both test suites, a full build, and the Storybook compile-check.
+# The PR gate. Matches ci.yml: codegen freshness, both linters, the formatter,
+# typecheck, both test suites, a full build, and the Storybook compile-check.
 .PHONY: verify
-verify: gen-check lint typecheck msw-worker-check test build build-storybook ## Full local gate (mirrors CI)
+verify: gen-check lint format-check typecheck msw-worker-check test build build-storybook ## Full local gate (mirrors CI)
 	@echo "verify: OK"

+ 21 - 0
docs/.oxfmtrc.json

@@ -0,0 +1,21 @@
+{
+  "$schema": "./node_modules/oxfmt/configuration_schema.json",
+  "semi": true,
+  "singleQuote": true,
+  "trailingComma": "all",
+  "printWidth": 100,
+  "tabWidth": 2,
+  "ignorePatterns": [
+    "node_modules",
+    ".next",
+    ".source",
+    "out",
+    "pnpm-lock.yaml",
+    "public/openapi.json",
+    // Reflowing MDX prose merges headings into paragraphs and collapses lists
+    // inside JSX components (Steps/Callout). Author MDX by hand.
+    "content/**/*.mdx",
+    // Generated API reference pages (fumadocs-openapi output).
+    "content/docs/**/reference/api"
+  ]
+}

+ 42 - 0
docs/.oxlintrc.json

@@ -0,0 +1,42 @@
+{
+  "$schema": "./node_modules/oxlint/configuration_schema.json",
+  "ignorePatterns": [
+    ".next/**",
+    ".source/**",
+    "out/**",
+    "node_modules/**",
+    "next-env.d.ts",
+    "content/docs/**/reference/api/**"
+  ],
+  "plugins": ["typescript", "react", "nextjs", "jsx-a11y", "import"],
+  "categories": {
+    "correctness": "error"
+  },
+  "env": {
+    "browser": true,
+    "node": true,
+    "es2022": true
+  },
+  "rules": {
+    "no-var": "error",
+    "prefer-const": "error",
+    "prefer-rest-params": "error",
+    "prefer-spread": "error",
+    "typescript/no-explicit-any": "error",
+    "typescript/no-unused-vars": "warn",
+    "typescript/ban-ts-comment": "error",
+    "typescript/no-empty-object-type": "error",
+    "typescript/no-namespace": "error",
+    "typescript/no-require-imports": "error",
+    "typescript/no-this-alias": "error",
+    "typescript/no-unsafe-function-type": "error",
+    "typescript/no-unused-expressions": "warn",
+    "typescript/no-wrapper-object-types": "error",
+    "typescript/prefer-as-const": "error",
+    "typescript/triple-slash-reference": "error",
+    "react-hooks/rules-of-hooks": "error",
+    "react-hooks/exhaustive-deps": "warn",
+    "import/no-anonymous-default-export": "warn",
+    "jsx-a11y/prefer-tag-over-role": "off"
+  }
+}

+ 0 - 10
docs/.prettierignore

@@ -1,10 +0,0 @@
-node_modules
-.next
-.source
-out
-pnpm-lock.yaml
-public/openapi.json
-# Don't let Prettier reflow MDX prose — it merges headings into paragraphs and
-# collapses lists inside JSX components (Steps/Callout). Author MDX by hand.
-content/**/*.mdx
-content/docs/**/reference/api

+ 0 - 7
docs/.prettierrc.json

@@ -1,7 +0,0 @@
-{
-  "semi": true,
-  "singleQuote": true,
-  "trailingComma": "all",
-  "printWidth": 100,
-  "tabWidth": 2
-}

+ 3 - 3
docs/CONTRIBUTING.md

@@ -20,12 +20,12 @@ pnpm dev        # http://localhost:3000
 | `pnpm build`     | Production build                                      |
 | `pnpm start`     | Serve the production build                            |
 | `pnpm typecheck` | Generate MDX/route types and run `tsc --noEmit`       |
-| `pnpm lint`      | ESLint (flat config)                                  |
-| `pnpm format`    | Format with Prettier                                  |
+| `pnpm lint`      | oxlint (`.oxlintrc.json`)                             |
+| `pnpm format`    | Format with oxfmt (`.oxfmtrc.json`)                   |
 | `pnpm test`      | Run unit tests (Vitest) for `lib/xray/*` pure logic   |
 | `pnpm gen:api`   | Generate the API reference from `public/openapi.json` |
 
-Before opening a pull request, please run `pnpm typecheck`, `pnpm lint`, and
+Before opening a pull request, please run `pnpm typecheck`, `pnpm lint`, `pnpm format:check`, and
 `pnpm test` — these are the same checks that CI runs on every PR.
 
 ## License

+ 16 - 16
docs/README.md

@@ -63,15 +63,15 @@ ever leaves your browser**:
 
 ## Tech stack
 
-| Layer      | Technology                                                  |
-| ---------- | ---------------------------------------------------------- |
-| Framework  | [Next.js 16](https://nextjs.org) (App Router) · React 19   |
-| Docs       | [Fumadocs](https://fumadocs.dev) (`-ui` / `-core` / `-mdx`) |
-| Styling    | [Tailwind CSS v4](https://tailwindcss.com)                 |
-| Search     | [Orama](https://orama.com) static index                    |
-| Language   | TypeScript (strict)                                         |
-| Tests      | [Vitest](https://vitest.dev) for the pure `lib/xray` logic  |
-| Tooling    | pnpm · ESLint 9 · Prettier                                  |
+| Layer     | Technology                                                  |
+| --------- | ----------------------------------------------------------- |
+| Framework | [Next.js 16](https://nextjs.org) (App Router) · React 19    |
+| Docs      | [Fumadocs](https://fumadocs.dev) (`-ui` / `-core` / `-mdx`) |
+| Styling   | [Tailwind CSS v4](https://tailwindcss.com)                  |
+| Search    | [Orama](https://orama.com) static index                     |
+| Language  | TypeScript (strict)                                         |
+| Tests     | [Vitest](https://vitest.dev) for the pure `lib/xray` logic  |
+| Tooling   | pnpm · oxlint · oxfmt                                       |
 
 ## Quick start
 
@@ -86,13 +86,13 @@ pnpm dev        # http://localhost:3000
 
 Useful scripts:
 
-| Script           | Description                                  |
-| ---------------- | -------------------------------------------- |
-| `pnpm dev`       | Start the dev server                         |
-| `pnpm build`     | Production build (also typechecks)           |
-| `pnpm typecheck` | Generate MDX/route types and `tsc --noEmit`  |
-| `pnpm lint`      | Run ESLint                                    |
-| `pnpm test`      | Run unit tests (Vitest)                       |
+| Script           | Description                                 |
+| ---------------- | ------------------------------------------- |
+| `pnpm dev`       | Start the dev server                        |
+| `pnpm build`     | Production build (also typechecks)          |
+| `pnpm typecheck` | Generate MDX/route types and `tsc --noEmit` |
+| `pnpm lint`      | Run oxlint (`.oxlintrc.json`)               |
+| `pnpm test`      | Run unit tests (Vitest)                     |
 
 See [`CONTRIBUTING.md`](./CONTRIBUTING.md) for the full list and project conventions.
 

+ 2 - 7
docs/app/api/search/route.ts

@@ -5,13 +5,8 @@ import { createFromSource } from 'fumadocs-core/search/server';
 export const revalidate = false;
 export const dynamic = 'force-static';
 
-// Static search index: works under both SSR/Vercel and static export
-// (`output: 'export'`). The client loads this prebuilt index and searches
-// in-browser (see the `type: 'static'` search option in app/[lang]/layout.tsx).
-// All locales currently hold English (fallback) content, and Orama has no
-// Persian tokenizer, so map every locale to the English tokenizer. When real
-// translations land, switch ru -> 'russian', zh -> 'mandarin' (with
-// @orama/tokenizers), etc. See https://docs.orama.com/open-source/supported-languages
+// Every locale still serves English fallback content, so all map to zbsearch's
+// English tokenizer (its SUPPORTED_LANGUAGES has no Persian or Chinese anyway).
 export const { staticGET: GET } = createFromSource(source, {
   localeMap: {
     en: 'english',

+ 101 - 95
docs/architecture.md

@@ -29,17 +29,17 @@ token), with a process restart as the fallback on older binaries.
 
 Servers and processes, all launched from `main.go`:
 
-| Server / process | Package | Purpose | Default port |
-|---|---|---|---|
-| **Panel** | `internal/web` | Admin REST/WS API + serves the embedded SPA | 2053 |
-| **Subscription** | `internal/sub` | Public endpoint that hands out client configs (raw / JSON / Clash) | `subPort` setting |
-| **Xray-core** | supervised via `internal/xray` | The actual proxy engine; a child process, not Go code | `inbounds[].port` |
-| **mtg-multi** | supervised via `internal/mtproto` | MTProto proxy child process for MTProto inbounds (multi-secret) | per inbound |
+| Server / process | Package                           | Purpose                                                            | Default port      |
+| ---------------- | --------------------------------- | ------------------------------------------------------------------ | ----------------- |
+| **Panel**        | `internal/web`                    | Admin REST/WS API + serves the embedded SPA                        | 2053              |
+| **Subscription** | `internal/sub`                    | Public endpoint that hands out client configs (raw / JSON / Clash) | `subPort` setting |
+| **Xray-core**    | supervised via `internal/xray`    | The actual proxy engine; a child process, not Go code              | `inbounds[].port` |
+| **mtg-multi**    | supervised via `internal/mtproto` | MTProto proxy child process for MTProto inbounds (multi-secret)    | per inbound       |
 
 Two key ideas that explain most of the complexity:
 
 1. **The DB → Xray config pipeline.** Inbounds/clients live in the DB. On every change the
-   backend regenerates the Xray config and applies it — preferring a *hot diff* (live gRPC
+   backend regenerates the Xray config and applies it — preferring a _hot diff_ (live gRPC
    API mutation) over a full process restart. See §5.1.
 2. **The Runtime abstraction (multi-node).** A panel can manage remote "nodes" (other 3x-ui
    instances). Every state-changing inbound/client operation is dispatched through a
@@ -52,6 +52,7 @@ Two key ideas that explain most of the complexity:
 ## 2. Tech stack
 
 **Backend (Go 1.26):**
+
 - Web framework: **Gin** (`gin-gonic/gin`) + sessions (cookie store), gzip.
 - ORM: **GORM** with **SQLite** (default) or **PostgreSQL** (`XUI_DB_TYPE=postgres`).
 - Scheduler: **robfig/cron/v3** (seconds-precision) for all background jobs.
@@ -61,6 +62,7 @@ Two key ideas that explain most of the complexity:
 - Misc: gorilla/websocket, gopsutil (system stats), go-qrcode, gotp (2FA TOTP).
 
 **Frontend (`frontend/`):**
+
 - **React 19** + **Ant Design 6** + **Vite 8** + **TypeScript**.
 - Data layer: **TanStack Query** (`@tanstack/react-query`) over the native **Fetch API**; **Zod 4** schemas.
 - Router: **react-router 8**. Charts: **uPlot** (`frontend/src/components/viz/Sparkline.tsx`). Editor: **CodeMirror 6**.
@@ -95,7 +97,7 @@ Browser (React, fetch)
 ```
 
 The controller layer is thin. **Business logic lives in services.** When something is wrong
-with *behavior*, the bug is almost always in a service file, not a controller.
+with _behavior_, the bug is almost always in a service file, not a controller.
 
 ### 3.2 Subscription request (end-user fetching their config)
 
@@ -312,8 +314,8 @@ Restart is debounced via an atomic "need restart" flag (`SetToNeedRestart` /
 ### 5.2 Runtime abstraction — Local vs Remote (multi-node) ⭐ most important
 
 A "node" (`model.Node`) is another 3x-ui instance this panel controls. Every state-changing
-inbound/client operation goes through the `runtime.Runtime` interface so the *same service
-code* works whether the target is the local Xray or a remote node.
+inbound/client operation goes through the `runtime.Runtime` interface so the _same service
+code_ works whether the target is the local Xray or a remote node.
 
 - **Interface:** `internal/web/runtime/runtime.go` — `Name`, `AddInbound`, `DelInbound`,
   `UpdateInbound`, `AddUser`, `RemoveUser`, `UpdateUser`, `DeleteUser`, `AddClient`,
@@ -329,7 +331,7 @@ code* works whether the target is the local Xray or a remote node.
 - **Dispatch:** `manager.go` → `Manager.RuntimeFor(nodeID *int)`; `nil` nodeID → `Local`,
   otherwise a cached/lazy-loaded `Remote`. `InvalidateNode(id)` drops a cached remote client.
 
-**Node identity & attribution (the hard part).** Inbounds carry a `NodeID` *and* an
+**Node identity & attribution (the hard part).** Inbounds carry a `NodeID` _and_ an
 `OriginNodeGuid`. Because inbounds can be pushed across hops, the panel attributes traffic and
 online clients back to the originating panel using **stable GUIDs** rather than local IDs.
 Relevant logic: `service/inbound_node.go` (`ReconcileNode`, `SetRemoteTraffic`, GUID merge,
@@ -338,6 +340,7 @@ tracking). Node "dirty" flags drive an **anti-entropy reconciliation** so an off
 inbound edits converge once it reconnects.
 
 **Where to look for node bugs:**
+
 - Operation not reaching a node → `runtime/remote.go` + `runtime/manager.go`.
 - Wrong traffic/online attribution across hops → `service/inbound_node.go` (GUID merge paths).
 - Node shown offline / stale status → `job/node_heartbeat_job.go` + `service/node.go` (`Probe`, `UpdateHeartbeat`).
@@ -360,28 +363,28 @@ Periodic resets: `job/periodic_traffic_reset_job.go` (keyed off `Inbound.Traffic
 
 All registered in `web.go` → `startTask()`. Each is a struct with a `Run()` method in `internal/web/job/`:
 
-| Schedule | Job | Purpose / condition |
-|---|---|---|
-| `@every 1s` | `check_xray_running_job` | Restart Xray if it died (2 consecutive down checks) |
-| `@every 30s` | (inline func in `startTask`) | Debounced Xray restart — consumes the "need restart" flag (§5.1) |
-| `@every 5s` | `xray_traffic_job` | Pull traffic stats from Xray (5s start delay) |
-| `@every 5s` | `node_heartbeat_job` | Probe child nodes (online/offline) |
-| `@every 5s` | `node_traffic_sync_job` | Pull + merge node traffic; push reconciliation |
-| `@every 10s` | `check_client_ip_job` | Enforce per-client IP limits |
-| `@every 10s` | `mtproto_job` | Reconcile `mtg` sidecars against enabled MTProto inbounds |
-| `@every 5m` | `outbound_subscription_job` | Refresh outbound provider configs |
-| `@every 10m` | `clear_logs_job` (`PruneXrayLogsJob`) | Truncate Xray access/error logs once either exceeds 64 MiB |
-| `@hourly` | `warp_ip_job`, `periodic_traffic_reset_job("hourly")` | WARP IP rotation; traffic resets |
-| `@daily` | `clear_logs_job`, `periodic_traffic_reset_job("daily")`, `periodic_traffic_reset_job("monthly")` | IP-limit and Xray access/error log cleanup; daily resets and due monthly resets |
-| `@weekly` | `periodic_traffic_reset_job("weekly")` | Weekly traffic resets |
-| default `@every 1m` | `ldap_sync_job` | Only if LDAP enabled; schedule configurable |
-| default `@daily` | `stats_notify_job` | Only if TG bot enabled; schedule configurable |
-| `@every 2m` | `check_hash_storage` | Only if TG bot enabled; expires bot callback hashes |
-| `@every 1m` | `check_cpu_usage` | Only if a CPU alarm is configured (TG or email); publishes `cpu.high` |
-| `@every 1m` | `check_memory_usage` | Only if a memory alarm is configured; publishes `memory.high` |
-| configurable | `free_os_memory` | Only if `sys.MemoryReleaseIntervalMinutes() > 0`; returns heap to OS |
-
-To change *when* something runs, edit `startTask()`. To change *what* it does, edit the job file.
+| Schedule            | Job                                                                                              | Purpose / condition                                                             |
+| ------------------- | ------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------- |
+| `@every 1s`         | `check_xray_running_job`                                                                         | Restart Xray if it died (2 consecutive down checks)                             |
+| `@every 30s`        | (inline func in `startTask`)                                                                     | Debounced Xray restart — consumes the "need restart" flag (§5.1)                |
+| `@every 5s`         | `xray_traffic_job`                                                                               | Pull traffic stats from Xray (5s start delay)                                   |
+| `@every 5s`         | `node_heartbeat_job`                                                                             | Probe child nodes (online/offline)                                              |
+| `@every 5s`         | `node_traffic_sync_job`                                                                          | Pull + merge node traffic; push reconciliation                                  |
+| `@every 10s`        | `check_client_ip_job`                                                                            | Enforce per-client IP limits                                                    |
+| `@every 10s`        | `mtproto_job`                                                                                    | Reconcile `mtg` sidecars against enabled MTProto inbounds                       |
+| `@every 5m`         | `outbound_subscription_job`                                                                      | Refresh outbound provider configs                                               |
+| `@every 10m`        | `clear_logs_job` (`PruneXrayLogsJob`)                                                            | Truncate Xray access/error logs once either exceeds 64 MiB                      |
+| `@hourly`           | `warp_ip_job`, `periodic_traffic_reset_job("hourly")`                                            | WARP IP rotation; traffic resets                                                |
+| `@daily`            | `clear_logs_job`, `periodic_traffic_reset_job("daily")`, `periodic_traffic_reset_job("monthly")` | IP-limit and Xray access/error log cleanup; daily resets and due monthly resets |
+| `@weekly`           | `periodic_traffic_reset_job("weekly")`                                                           | Weekly traffic resets                                                           |
+| default `@every 1m` | `ldap_sync_job`                                                                                  | Only if LDAP enabled; schedule configurable                                     |
+| default `@daily`    | `stats_notify_job`                                                                               | Only if TG bot enabled; schedule configurable                                   |
+| `@every 2m`         | `check_hash_storage`                                                                             | Only if TG bot enabled; expires bot callback hashes                             |
+| `@every 1m`         | `check_cpu_usage`                                                                                | Only if a CPU alarm is configured (TG or email); publishes `cpu.high`           |
+| `@every 1m`         | `check_memory_usage`                                                                             | Only if a memory alarm is configured; publishes `memory.high`                   |
+| configurable        | `free_os_memory`                                                                                 | Only if `sys.MemoryReleaseIntervalMinutes() > 0`; returns heap to OS            |
+
+To change _when_ something runs, edit `startTask()`. To change _what_ it does, edit the job file.
 
 ### 5.5 Type generation (Go → TypeScript) ⚠️ don't hand-edit generated files
 
@@ -400,8 +403,9 @@ frontend types (`cd frontend && npm run gen`) instead of editing `src/generated/
 ### 5.6 Share-link / subscription generation
 
 Two distinct code paths produce client configs:
+
 - **Per-client links in the panel** (the "copy link" / QR in the UI): `service/client_link.go`
-  + `util/link/outbound.go`.
+  - `util/link/outbound.go`.
 - **Subscription endpoint** (what a client app polls): `internal/sub/service.go` (raw links),
   `internal/sub/json_service.go` (JSON), `internal/sub/clash_service.go` (Clash YAML).
   **`Host` rows** (`model.Host`, edited under /panel/api/hosts) override address/SNI/path/
@@ -438,70 +442,70 @@ Xray restart.
 GORM models in `internal/database/model/` (main file `model.go` + siblings); all registered
 for AutoMigrate in `internal/database/db.go`.
 
-| Model | Table role | Notable fields |
-|---|---|---|
-| `User` | Admin login | bcrypt password, `LoginEpoch` (invalidates sessions) |
-| `Inbound` | An Xray inbound | `Tag` (unique), `Port`, `Protocol`, `Settings`/`StreamSettings`/`Sniffing` (JSON), `Enable`, `TrafficReset`, `NodeID`, **`OriginNodeGuid`**, `ClientStats` (assoc) |
-| `Client` | In-memory client view | UUID/email/flow/limits (parsed from inbound JSON; not persisted) |
-| `ClientRecord` | Persisted client (`clients`) | `Email` (unique), `SubID`, `UUID`, `TotalGB`, `ExpiryTime`, `LimitIP`, `Group`, `Reset` |
-| `ClientGroup` / `ClientInbound` | Grouping + client↔inbound join | many-to-many wiring, `FlowOverride` |
-| `ClientExternalLink` | Extra links attached to a client | `Kind`, `Value`, `Remark`, `SortIndex` |
-| `Host` | Subscription host overrides (per inbound) | `Address`, `Port`, `Sni`, `Path`, `Security`, `Fingerprint`, `SortOrder`, visibility/exclusion flags |
-| `Node` | A managed child panel | `Guid`, `Address`, `Status`, `TlsVerifyMode`, `PinnedCertSha256`, `ConfigDirty`, version/heartbeat/metric fields |
-| `NodeClientTraffic` | Per-node client traffic baseline | cross-node merge (anti-double-count) |
-| `NodeClientIp` | Per-node client IP attribution | `NodeGuid`, `Email`, `Ips` |
-| `ClientGlobalTraffic` | Cross-master usage totals | `MasterGuid`, `Email`, `Up`, `Down` |
-| `xray.ClientTraffic` | Per-client counters (`client_traffics`) | `Email`, `Up`, `Down`, `Total`, `ExpiryTime`, `LastOnline` |
-| `InboundClientIps` | IP set per client email | drives IP-limit enforcement |
-| `OutboundTraffics` | Outbound counters | per outbound tag |
-| `OutboundSubscription` | External provider subs | Warp/Nord style |
-| `Setting` | Key/value panel settings | everything configurable |
-| `ApiToken` | REST API tokens | SHA-256 hash (plaintext shown once) |
-| `InboundFallback` | Fallback routing on a shared port | SNI/ALPN/path → dest |
-| `HistoryOfSeeders` | Seeder bookkeeping | prevents re-running one-off migrations |
+| Model                           | Table role                                | Notable fields                                                                                                                                                     |
+| ------------------------------- | ----------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `User`                          | Admin login                               | bcrypt password, `LoginEpoch` (invalidates sessions)                                                                                                               |
+| `Inbound`                       | An Xray inbound                           | `Tag` (unique), `Port`, `Protocol`, `Settings`/`StreamSettings`/`Sniffing` (JSON), `Enable`, `TrafficReset`, `NodeID`, **`OriginNodeGuid`**, `ClientStats` (assoc) |
+| `Client`                        | In-memory client view                     | UUID/email/flow/limits (parsed from inbound JSON; not persisted)                                                                                                   |
+| `ClientRecord`                  | Persisted client (`clients`)              | `Email` (unique), `SubID`, `UUID`, `TotalGB`, `ExpiryTime`, `LimitIP`, `Group`, `Reset`                                                                            |
+| `ClientGroup` / `ClientInbound` | Grouping + client↔inbound join            | many-to-many wiring, `FlowOverride`                                                                                                                                |
+| `ClientExternalLink`            | Extra links attached to a client          | `Kind`, `Value`, `Remark`, `SortIndex`                                                                                                                             |
+| `Host`                          | Subscription host overrides (per inbound) | `Address`, `Port`, `Sni`, `Path`, `Security`, `Fingerprint`, `SortOrder`, visibility/exclusion flags                                                               |
+| `Node`                          | A managed child panel                     | `Guid`, `Address`, `Status`, `TlsVerifyMode`, `PinnedCertSha256`, `ConfigDirty`, version/heartbeat/metric fields                                                   |
+| `NodeClientTraffic`             | Per-node client traffic baseline          | cross-node merge (anti-double-count)                                                                                                                               |
+| `NodeClientIp`                  | Per-node client IP attribution            | `NodeGuid`, `Email`, `Ips`                                                                                                                                         |
+| `ClientGlobalTraffic`           | Cross-master usage totals                 | `MasterGuid`, `Email`, `Up`, `Down`                                                                                                                                |
+| `xray.ClientTraffic`            | Per-client counters (`client_traffics`)   | `Email`, `Up`, `Down`, `Total`, `ExpiryTime`, `LastOnline`                                                                                                         |
+| `InboundClientIps`              | IP set per client email                   | drives IP-limit enforcement                                                                                                                                        |
+| `OutboundTraffics`              | Outbound counters                         | per outbound tag                                                                                                                                                   |
+| `OutboundSubscription`          | External provider subs                    | Warp/Nord style                                                                                                                                                    |
+| `Setting`                       | Key/value panel settings                  | everything configurable                                                                                                                                            |
+| `ApiToken`                      | REST API tokens                           | SHA-256 hash (plaintext shown once)                                                                                                                                |
+| `InboundFallback`               | Fallback routing on a shared port         | SNI/ALPN/path → dest                                                                                                                                               |
+| `HistoryOfSeeders`              | Seeder bookkeeping                        | prevents re-running one-off migrations                                                                                                                             |
 
 ---
 
 ## 7. Symptom → File index (start here when debugging)
 
-| Symptom / task | Primary file(s) | Then check |
-|---|---|---|
-| Add/modify an **API endpoint** | `controller/<resource>.go` (route registration at top of each file) | corresponding `service/*.go`, `frontend/src/pages/api-docs/endpoints.ts` |
-| **Inbound** create/update/delete behavior | `service/inbound.go`, `service/inbound_clients.go` | `runtime/*`, `service/xray.go` |
-| **Client** CRUD / limits / expiry | `service/client_crud.go`, `service/client_inbound_apply.go` | model `ClientRecord`, `service/inbound_traffic.go` |
-| **Bulk** client operations slow/wrong | `service/client_bulk.go` | `service/client_paging.go` |
-| Xray **won't apply** a config change | `service/xray.go` (`RestartXray`, `tryHotApply`) | `xray/hot_diff.go`, `xray/process.go` |
-| Xray **restarts when it shouldn't** (kills connections) | `xray/hot_diff.go` (diff not classified as hot) | `service/xray.go` |
-| **Traffic** counts wrong / reset behavior | `service/inbound_traffic.go`, `job/xray_traffic_job.go` | `service/traffic_writer.go`, `job/periodic_traffic_reset_job.go` |
-| **Node** operation not propagating | `runtime/remote.go`, `runtime/manager.go` | `service/inbound_node.go` |
-| **Multi-hop / cross-node attribution** (traffic or online clients on wrong panel) | `service/inbound_node.go` (GUID merge, `synthNodeGuid`, `effectiveNodeGuid`) | `service/node.go`, model `OriginNodeGuid`/`Node.Guid` |
-| Node stuck **offline / stale** | `job/node_heartbeat_job.go`, `service/node.go` (`Probe`, `UpdateHeartbeat`) | `runtime/tls_client.go` (TLS verify) |
-| Node **TLS / mTLS** auth failures | `runtime/tls_client.go`, `service/node_mtls.go`, `service/setting_mtls.go` | `service/node.go` (`FetchCertFingerprint`) |
-| Offline node edits **not reconciling** on reconnect | `service/inbound_node.go` (`ReconcileNode`, dirty flags) | `service/node.go` (`MarkNodeDirty`/`NodeSyncState`) |
-| **Share link / QR** malformed (per protocol) | `service/client_link.go`, `util/link/outbound.go` | `frontend/src/lib/xray/`, `frontend/src/schemas/protocols/` |
-| **Subscription** output wrong (raw/JSON/Clash) | `internal/sub/service.go` | `sub/json_service.go`, `sub/clash_service.go`, sub golden tests |
-| Subscription **host overrides** not applied | `service/host.go`, `sub/host_sub.go` | model `Host`, `frontend/src/pages/hosts/` |
-| **External subscription** import/aggregation | `sub/external_subscription.go`, `sub/external_config.go` | `sub/clash_external.go` |
-| **Settings** not saving / defaults | `service/setting.go`, `controller/setting.go` | model `Setting` |
-| **Login / 2FA / sessions / CSRF** | `controller/index.go`, `service/panel/user.go`, `middleware/` | `session/` |
-| **API tokens** | `service/panel/api_token.go`, `controller/setting.go` | model `ApiToken` |
-| **Port conflict** on inbound add | `service/port_conflict.go` | `controller/inbound.go` |
-| **Fallbacks** (shared 443, SNI routing) | `service/fallback.go`, `controller/inbound.go` | model `InboundFallback` |
-| **Geo category browser** empty / won't open | `xray/geodata/` (`Store`, `reader.go`), `service/geodata.go` | `controller/xray_setting.go` (`/panel/api/xray/geodata/*`), asset dir = `config.GetBinFolderPath()` |
-| **`geosite:`/`geoip:` token** reported unknown in a routing rule | `xray/geodata/token.go`, `service/geodata.go` (`Validate`) | `frontend/src/lib/xray/geoTokens.ts`, `frontend/src/components/geodata/` |
-| **Telegram bot** commands | `service/tgbot/` | `job/stats_notify_job.go` |
-| **Email notifications** | `service/email/` | `internal/eventbus/` (consumers) |
-| **CPU / memory alerts** not firing | `job/check_cpu_usage.go`, `job/check_memory_usage.go` | `internal/eventbus/`, notifier settings in `service/setting.go` |
-| Xray auto-restart on **dead tunnel** | `internal/tunnelmonitor/` | `XUI_TUNNEL_HEALTH_*` in `internal/config/` |
-| **WARP / Nord** outbound integration | `service/integration/warp.go` / `nord.go` | `service/outbound_subscription.go` |
-| **MTProto** proxy issues | `internal/mtproto/manager.go`, `mtproto/process*.go` | `job/mtproto_job.go` |
-| **DB migration** / new column | `internal/database/db.go` (AutoMigrate list), `migrate_data.go` | `model/model.go` |
-| **Cron schedule** changes | `web.go` → `startTask()` | the specific `job/*.go` |
-| **CORS / security headers / HTTPS** | `middleware/`, `web.go` (`initRouter`, TLS setup) | `config/` (env) |
-| **Env vars / paths / DB type** | `internal/config/config.go` | `.env.example` |
-| **Frontend route / screen** | `frontend/src/pages/<area>/`, `frontend/src/routes.tsx` | `frontend/src/api/queries/` |
-| **Frontend ↔ backend type mismatch** | regenerate: `cd frontend && npm run gen` (`tools/openapigen`) | `frontend/src/generated/` |
-| **System status / CPU / metrics** | `service/server.go`, `service/xray_metrics.go`, `service/metric_history.go` | `controller/server.go`, gopsutil |
+| Symptom / task                                                                    | Primary file(s)                                                              | Then check                                                                                          |
+| --------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------- |
+| Add/modify an **API endpoint**                                                    | `controller/<resource>.go` (route registration at top of each file)          | corresponding `service/*.go`, `frontend/src/pages/api-docs/endpoints.ts`                            |
+| **Inbound** create/update/delete behavior                                         | `service/inbound.go`, `service/inbound_clients.go`                           | `runtime/*`, `service/xray.go`                                                                      |
+| **Client** CRUD / limits / expiry                                                 | `service/client_crud.go`, `service/client_inbound_apply.go`                  | model `ClientRecord`, `service/inbound_traffic.go`                                                  |
+| **Bulk** client operations slow/wrong                                             | `service/client_bulk.go`                                                     | `service/client_paging.go`                                                                          |
+| Xray **won't apply** a config change                                              | `service/xray.go` (`RestartXray`, `tryHotApply`)                             | `xray/hot_diff.go`, `xray/process.go`                                                               |
+| Xray **restarts when it shouldn't** (kills connections)                           | `xray/hot_diff.go` (diff not classified as hot)                              | `service/xray.go`                                                                                   |
+| **Traffic** counts wrong / reset behavior                                         | `service/inbound_traffic.go`, `job/xray_traffic_job.go`                      | `service/traffic_writer.go`, `job/periodic_traffic_reset_job.go`                                    |
+| **Node** operation not propagating                                                | `runtime/remote.go`, `runtime/manager.go`                                    | `service/inbound_node.go`                                                                           |
+| **Multi-hop / cross-node attribution** (traffic or online clients on wrong panel) | `service/inbound_node.go` (GUID merge, `synthNodeGuid`, `effectiveNodeGuid`) | `service/node.go`, model `OriginNodeGuid`/`Node.Guid`                                               |
+| Node stuck **offline / stale**                                                    | `job/node_heartbeat_job.go`, `service/node.go` (`Probe`, `UpdateHeartbeat`)  | `runtime/tls_client.go` (TLS verify)                                                                |
+| Node **TLS / mTLS** auth failures                                                 | `runtime/tls_client.go`, `service/node_mtls.go`, `service/setting_mtls.go`   | `service/node.go` (`FetchCertFingerprint`)                                                          |
+| Offline node edits **not reconciling** on reconnect                               | `service/inbound_node.go` (`ReconcileNode`, dirty flags)                     | `service/node.go` (`MarkNodeDirty`/`NodeSyncState`)                                                 |
+| **Share link / QR** malformed (per protocol)                                      | `service/client_link.go`, `util/link/outbound.go`                            | `frontend/src/lib/xray/`, `frontend/src/schemas/protocols/`                                         |
+| **Subscription** output wrong (raw/JSON/Clash)                                    | `internal/sub/service.go`                                                    | `sub/json_service.go`, `sub/clash_service.go`, sub golden tests                                     |
+| Subscription **host overrides** not applied                                       | `service/host.go`, `sub/host_sub.go`                                         | model `Host`, `frontend/src/pages/hosts/`                                                           |
+| **External subscription** import/aggregation                                      | `sub/external_subscription.go`, `sub/external_config.go`                     | `sub/clash_external.go`                                                                             |
+| **Settings** not saving / defaults                                                | `service/setting.go`, `controller/setting.go`                                | model `Setting`                                                                                     |
+| **Login / 2FA / sessions / CSRF**                                                 | `controller/index.go`, `service/panel/user.go`, `middleware/`                | `session/`                                                                                          |
+| **API tokens**                                                                    | `service/panel/api_token.go`, `controller/setting.go`                        | model `ApiToken`                                                                                    |
+| **Port conflict** on inbound add                                                  | `service/port_conflict.go`                                                   | `controller/inbound.go`                                                                             |
+| **Fallbacks** (shared 443, SNI routing)                                           | `service/fallback.go`, `controller/inbound.go`                               | model `InboundFallback`                                                                             |
+| **Geo category browser** empty / won't open                                       | `xray/geodata/` (`Store`, `reader.go`), `service/geodata.go`                 | `controller/xray_setting.go` (`/panel/api/xray/geodata/*`), asset dir = `config.GetBinFolderPath()` |
+| **`geosite:`/`geoip:` token** reported unknown in a routing rule                  | `xray/geodata/token.go`, `service/geodata.go` (`Validate`)                   | `frontend/src/lib/xray/geoTokens.ts`, `frontend/src/components/geodata/`                            |
+| **Telegram bot** commands                                                         | `service/tgbot/`                                                             | `job/stats_notify_job.go`                                                                           |
+| **Email notifications**                                                           | `service/email/`                                                             | `internal/eventbus/` (consumers)                                                                    |
+| **CPU / memory alerts** not firing                                                | `job/check_cpu_usage.go`, `job/check_memory_usage.go`                        | `internal/eventbus/`, notifier settings in `service/setting.go`                                     |
+| Xray auto-restart on **dead tunnel**                                              | `internal/tunnelmonitor/`                                                    | `XUI_TUNNEL_HEALTH_*` in `internal/config/`                                                         |
+| **WARP / Nord** outbound integration                                              | `service/integration/warp.go` / `nord.go`                                    | `service/outbound_subscription.go`                                                                  |
+| **MTProto** proxy issues                                                          | `internal/mtproto/manager.go`, `mtproto/process*.go`                         | `job/mtproto_job.go`                                                                                |
+| **DB migration** / new column                                                     | `internal/database/db.go` (AutoMigrate list), `migrate_data.go`              | `model/model.go`                                                                                    |
+| **Cron schedule** changes                                                         | `web.go` → `startTask()`                                                     | the specific `job/*.go`                                                                             |
+| **CORS / security headers / HTTPS**                                               | `middleware/`, `web.go` (`initRouter`, TLS setup)                            | `config/` (env)                                                                                     |
+| **Env vars / paths / DB type**                                                    | `internal/config/config.go`                                                  | `.env.example`                                                                                      |
+| **Frontend route / screen**                                                       | `frontend/src/pages/<area>/`, `frontend/src/routes.tsx`                      | `frontend/src/api/queries/`                                                                         |
+| **Frontend ↔ backend type mismatch**                                              | regenerate: `cd frontend && npm run gen` (`tools/openapigen`)                | `frontend/src/generated/`                                                                           |
+| **System status / CPU / metrics**                                                 | `service/server.go`, `service/xray_metrics.go`, `service/metric_history.go`  | `controller/server.go`, gopsutil                                                                    |
 
 ---
 
@@ -522,7 +526,7 @@ for AutoMigrate in `internal/database/db.go`.
    Regenerate instead.
 7. **Models are the contract.** Changing a model field that crosses the API boundary means:
    update `model.go` → handle migration in `db.go`/`migrate_data.go` → regenerate frontend types.
-8. **Two servers, two concerns.** Admin features go in `internal/web`; anything an *end user*
+8. **Two servers, two concerns.** Admin features go in `internal/web`; anything an _end user_
    fetches goes in `internal/sub`. Don't blur them.
 9. **Cross-cutting notifications go through `internal/eventbus/`** — publish an event instead
    of importing the Telegram/email services into producers.
@@ -536,6 +540,7 @@ The canonical gate is the **Makefile** (mirrors CI): `make verify`. Also: `make
 frontend), `make race`, `make build`. Run `make help` for everything. Raw commands:
 
 **Backend (Go):**
+
 ```bash
 go build ./...                      # compile everything
 go test ./...                       # run all Go tests (many *_test.go alongside sources)
@@ -548,11 +553,12 @@ go run main.go                      # run the panel locally (serves embedded dis
 ```
 
 **Frontend (`cd frontend`, Node 24 — see `.nvmrc`):**
+
 ```bash
 npm install
 npm run dev          # Vite dev server on :5173; proxies API to Go backend on :2053 (run `go run main.go` too)
 npm run typecheck    # tsc --noEmit
-npm run lint         # eslint src
+npm run lint         # oxlint src
 npm run test         # vitest (incl. golden config-generation snapshots)
 npm run gen          # regenerate src/generated/* from Go (gen:zod + gen:api)
 npm run build        # gen:api + vite build → outputs to internal/web/dist (then rebuild Go binary to embed)

+ 4 - 8
docs/components/search-dialog.tsx

@@ -2,7 +2,7 @@
 
 import { create } from 'zbsearch';
 import { useDocsSearch } from 'fumadocs-core/search/client';
-import { oramaStaticClient } from 'fumadocs-core/search/client/orama-static';
+import { staticClient } from 'fumadocs-core/search/client/orama-static';
 import {
   SearchDialog,
   SearchDialogClose,
@@ -21,17 +21,13 @@ interface SharedProps {
   onOpenChange: (open: boolean) => void;
 }
 
-// The static search index is keyed by locale code (en/fa/ru/zh). Fumadocs'
-// default static dialog feeds those codes to Orama as a tokenizer language, but
-// Orama only accepts full names ("english") and throws on "en" — which silently
-// breaks search entirely. All docs content is English (other locales fall back
-// to it), so re-create the dialog — the documented escape hatch for custom search
-// setups — with an initDB that always builds an English index.
+// Fumadocs' default dialog passes the index's locale code as a tokenizer language,
+// and zbsearch throws on anything but a full name — so force "english" everywhere.
 export default function SearchDialogClient(props: SharedProps) {
   const { locale } = useI18n();
   const client = useMemo(
     () =>
-      oramaStaticClient({
+      staticClient({
         from: '/api/search',
         locale,
         initDB: () => create({ schema: { _: 'string' }, language: 'english' }),

+ 6 - 1
docs/components/tools/api-request-builder.tsx

@@ -1,7 +1,12 @@
 'use client';
 
 import { useId, useState } from 'react';
-import { buildCurl, buildFetchSnippet, type ApiRequestInput, type HttpMethod } from '@/lib/xray/api-client';
+import {
+  buildCurl,
+  buildFetchSnippet,
+  type ApiRequestInput,
+  type HttpMethod,
+} from '@/lib/xray/api-client';
 import { ToolFrame } from './tool-frame';
 import { TextField, SelectField } from './shared/fields';
 import { OutputBlock } from './shared/output-block';

+ 72 - 11
docs/components/tools/routing-builder.tsx

@@ -38,8 +38,24 @@ const DEFAULT_BALANCERS: BalancerRow[] = [
   { tag: 'balancer', selector: 'proxy', strategy: 'leastPing', fallbackTag: '' },
 ];
 const DEFAULT_RULES: RuleRow[] = [
-  { domain: 'geosite:category-ads-all', ip: '', port: '', network: 'any', inboundTag: '', targetKind: 'outbound', targetTag: 'block' },
-  { domain: '', ip: 'geoip:private', port: '', network: 'any', inboundTag: '', targetKind: 'outbound', targetTag: 'direct' },
+  {
+    domain: 'geosite:category-ads-all',
+    ip: '',
+    port: '',
+    network: 'any',
+    inboundTag: '',
+    targetKind: 'outbound',
+    targetTag: 'block',
+  },
+  {
+    domain: '',
+    ip: 'geoip:private',
+    port: '',
+    network: 'any',
+    inboundTag: '',
+    targetKind: 'outbound',
+    targetTag: 'direct',
+  },
 ];
 
 function list(s: string): string[] {
@@ -113,7 +129,10 @@ export function RoutingBuilder() {
           type="button"
           className={addBtn}
           onClick={() =>
-            setBalancers((p) => [...p, { tag: '', selector: '', strategy: 'random', fallbackTag: '' }])
+            setBalancers((p) => [
+              ...p,
+              { tag: '', selector: '', strategy: 'random', fallbackTag: '' },
+            ])
           }
         >
           Add balancer
@@ -163,7 +182,15 @@ export function RoutingBuilder() {
           onClick={() =>
             setRules((p) => [
               ...p,
-              { domain: '', ip: '', port: '', network: 'any', inboundTag: '', targetKind: 'outbound', targetTag: '' },
+              {
+                domain: '',
+                ip: '',
+                port: '',
+                network: 'any',
+                inboundTag: '',
+                targetKind: 'outbound',
+                targetTag: '',
+              },
             ])
           }
         >
@@ -174,13 +201,47 @@ export function RoutingBuilder() {
         {rules.map((r, i) => (
           <div key={i} className="rounded-xl border p-3">
             <div className="grid grid-cols-1 gap-3 sm:grid-cols-2">
-              <TextField label="Domain (comma)" value={r.domain} onChange={(v) => patchRule(i, { domain: v })} placeholder="geosite:google, example.com" />
-              <TextField label="IP (comma)" value={r.ip} onChange={(v) => patchRule(i, { ip: v })} placeholder="geoip:cn, 1.1.1.1" />
-              <TextField label="Port" value={r.port} onChange={(v) => patchRule(i, { port: v })} placeholder="443 or 1000-2000" />
-              <SelectField label="Network" value={r.network} onChange={(v) => patchRule(i, { network: v })} options={NETWORKS} />
-              <TextField label="Inbound tag (comma)" value={r.inboundTag} onChange={(v) => patchRule(i, { inboundTag: v })} placeholder="optional" />
-              <SelectField label="Target kind" value={r.targetKind} onChange={(v) => patchRule(i, { targetKind: v as 'outbound' | 'balancer' })} options={TARGET_KINDS} />
-              <TextField label="Target tag" value={r.targetTag} onChange={(v) => patchRule(i, { targetTag: v })} />
+              <TextField
+                label="Domain (comma)"
+                value={r.domain}
+                onChange={(v) => patchRule(i, { domain: v })}
+                placeholder="geosite:google, example.com"
+              />
+              <TextField
+                label="IP (comma)"
+                value={r.ip}
+                onChange={(v) => patchRule(i, { ip: v })}
+                placeholder="geoip:cn, 1.1.1.1"
+              />
+              <TextField
+                label="Port"
+                value={r.port}
+                onChange={(v) => patchRule(i, { port: v })}
+                placeholder="443 or 1000-2000"
+              />
+              <SelectField
+                label="Network"
+                value={r.network}
+                onChange={(v) => patchRule(i, { network: v })}
+                options={NETWORKS}
+              />
+              <TextField
+                label="Inbound tag (comma)"
+                value={r.inboundTag}
+                onChange={(v) => patchRule(i, { inboundTag: v })}
+                placeholder="optional"
+              />
+              <SelectField
+                label="Target kind"
+                value={r.targetKind}
+                onChange={(v) => patchRule(i, { targetKind: v as 'outbound' | 'balancer' })}
+                options={TARGET_KINDS}
+              />
+              <TextField
+                label="Target tag"
+                value={r.targetTag}
+                onChange={(v) => patchRule(i, { targetTag: v })}
+              />
             </div>
             <div className="mt-2 flex justify-end">
               <button

+ 38 - 7
docs/components/tools/subscription-builder.tsx

@@ -79,7 +79,15 @@ export function SubscriptionBuilder() {
     setClients((prev) => prev.map((c, j) => (i === j ? { ...c, ...p } : c)));
   }
 
-  const urlInput: SubUrlInput = { scheme, host, port: Number(port), subPath, jsonPath, subId, behindProxy };
+  const urlInput: SubUrlInput = {
+    scheme,
+    host,
+    port: Number(port),
+    subPath,
+    jsonPath,
+    subId,
+    behindProxy,
+  };
   const urls = buildSubscriptionUrls(urlInput);
   const subClients = clients.filter((c) => c.address.trim()).map(toClient);
 
@@ -159,16 +167,33 @@ export function SubscriptionBuilder() {
                 onChange={(v) => patch(i, { protocol: v as ClientProtocol })}
                 options={PROTOCOLS}
               />
-              <TextField label="Remark" value={c.remark} onChange={(v) => patch(i, { remark: v })} />
-              <TextField label="Address" value={c.address} onChange={(v) => patch(i, { address: v })} />
-              <TextField label="Port" value={c.port} onChange={(v) => patch(i, { port: v })} inputMode="numeric" />
+              <TextField
+                label="Remark"
+                value={c.remark}
+                onChange={(v) => patch(i, { remark: v })}
+              />
+              <TextField
+                label="Address"
+                value={c.address}
+                onChange={(v) => patch(i, { address: v })}
+              />
+              <TextField
+                label="Port"
+                value={c.port}
+                onChange={(v) => patch(i, { port: v })}
+                inputMode="numeric"
+              />
               <TextField
                 label={c.protocol === 'vless' || c.protocol === 'vmess' ? 'UUID (id)' : 'Password'}
                 value={c.credential}
                 onChange={(v) => patch(i, { credential: v })}
               />
               {c.protocol === 'ss' ? (
-                <TextField label="Method" value={c.method} onChange={(v) => patch(i, { method: v })} />
+                <TextField
+                  label="Method"
+                  value={c.method}
+                  onChange={(v) => patch(i, { method: v })}
+                />
               ) : null}
               <SelectField
                 label="Transport"
@@ -200,9 +225,15 @@ export function SubscriptionBuilder() {
       </div>
 
       <div className="mt-4 grid grid-cols-1 gap-4">
-        <OutputBlock label="Subscription links (decoded body)" value={buildShareLinks(subClients).join('\n')} />
+        <OutputBlock
+          label="Subscription links (decoded body)"
+          value={buildShareLinks(subClients).join('\n')}
+        />
         <OutputBlock label="Base64 body" value={buildBase64Subscription(subClients)} />
-        <OutputBlock label="JSON subscription (preview)" value={buildJsonSubscription(subClients)} />
+        <OutputBlock
+          label="JSON subscription (preview)"
+          value={buildJsonSubscription(subClients)}
+        />
       </div>
     </ToolFrame>
   );

+ 16 - 30
docs/content/docs/en/reference/api/authentication.mdx

@@ -1,8 +1,7 @@
 ---
 title: Authentication
-description: >-
-  Two authentication modes are supported. UI sessions use a cookie set by the
-  login endpoint. Programmatic clients (bots, scripts, remote panels)
+description: Two authentication modes are supported. UI sessions use a cookie
+  set by the login endpoint. Programmatic clients (bots, scripts, remote panels)
   authenticate with a Bearer token taken from Settings → Security → API Token.
   Both work for every endpoint under /panel/api/*.
 full: true
@@ -11,51 +10,38 @@ _openapi:
     - ./public/openapi.json
   toc:
     - depth: 2
-      title: >-
-        Authenticate with username + password and receive a session cookie.
+      title: Authenticate with username + password and receive a session cookie.
         Required before any cookie-based API call.
-      url: >-
-        #authenticate-with-username--password-and-receive-a-session-cookie-required-before-any-cookie-based-api-call
+      url: '#authenticate-with-username--password-and-receive-a-session-cookie-required-before-any-cookie-based-api-call'
     - depth: 2
       title: Clear the session cookie. Requires the CSRF header for browser sessions.
       url: '#clear-the-session-cookie-requires-the-csrf-header-for-browser-sessions'
     - depth: 2
-      title: >-
-        Mint a CSRF token for the current session. The SPA replays it in the
+      title: Mint a CSRF token for the current session. The SPA replays it in the
         X-CSRF-Token header on unsafe requests. Bearer-token callers can skip
         this — the middleware short-circuits CSRF for authenticated API
         requests.
-      url: >-
-        #mint-a-csrf-token-for-the-current-session-the-spa-replays-it-in-the-x-csrf-token-header-on-unsafe-requests-bearer-token-callers-can-skip-this--the-middleware-short-circuits-csrf-for-authenticated-api-requests
+      url: '#mint-a-csrf-token-for-the-current-session-the-spa-replays-it-in-the-x-csrf-token-header-on-unsafe-requests-bearer-token-callers-can-skip-this--the-middleware-short-circuits-csrf-for-authenticated-api-requests'
     - depth: 2
-      title: >-
-        Returns whether 2FA is enabled on the panel — used by the login page to
+      title: Returns whether 2FA is enabled on the panel — used by the login page to
         decide whether to show the OTP field.
-      url: >-
-        #returns-whether-2fa-is-enabled-on-the-panel--used-by-the-login-page-to-decide-whether-to-show-the-otp-field
+      url: '#returns-whether-2fa-is-enabled-on-the-panel--used-by-the-login-page-to-decide-whether-to-show-the-otp-field'
   structuredData:
     headings:
-      - content: >-
-          Authenticate with username + password and receive a session cookie.
+      - content: Authenticate with username + password and receive a session cookie.
           Required before any cookie-based API call.
-        id: >-
-          authenticate-with-username--password-and-receive-a-session-cookie-required-before-any-cookie-based-api-call
-      - content: >-
-          Clear the session cookie. Requires the CSRF header for browser
+        id: authenticate-with-username--password-and-receive-a-session-cookie-required-before-any-cookie-based-api-call
+      - content: Clear the session cookie. Requires the CSRF header for browser
           sessions.
         id: clear-the-session-cookie-requires-the-csrf-header-for-browser-sessions
-      - content: >-
-          Mint a CSRF token for the current session. The SPA replays it in the
+      - content: Mint a CSRF token for the current session. The SPA replays it in the
           X-CSRF-Token header on unsafe requests. Bearer-token callers can skip
           this — the middleware short-circuits CSRF for authenticated API
           requests.
-        id: >-
-          mint-a-csrf-token-for-the-current-session-the-spa-replays-it-in-the-x-csrf-token-header-on-unsafe-requests-bearer-token-callers-can-skip-this--the-middleware-short-circuits-csrf-for-authenticated-api-requests
-      - content: >-
-          Returns whether 2FA is enabled on the panel — used by the login page
-          to decide whether to show the OTP field.
-        id: >-
-          returns-whether-2fa-is-enabled-on-the-panel--used-by-the-login-page-to-decide-whether-to-show-the-otp-field
+        id: mint-a-csrf-token-for-the-current-session-the-spa-replays-it-in-the-x-csrf-token-header-on-unsafe-requests-bearer-token-callers-can-skip-this--the-middleware-short-circuits-csrf-for-authenticated-api-requests
+      - content: Returns whether 2FA is enabled on the panel — used by the login page to
+          decide whether to show the OTP field.
+        id: returns-whether-2fa-is-enabled-on-the-panel--used-by-the-login-page-to-decide-whether-to-show-the-otp-field
     contents: []
 ---
 

+ 4 - 8
docs/content/docs/en/reference/api/backup.mdx

@@ -7,18 +7,14 @@ _openapi:
     - ./public/openapi.json
   toc:
     - depth: 2
-      title: >-
-        Send a fresh DB backup to every Telegram chat configured as an admin
+      title: Send a fresh DB backup to every Telegram chat configured as an admin
         recipient. No body, no params.
-      url: >-
-        #send-a-fresh-db-backup-to-every-telegram-chat-configured-as-an-admin-recipient-no-body-no-params
+      url: '#send-a-fresh-db-backup-to-every-telegram-chat-configured-as-an-admin-recipient-no-body-no-params'
   structuredData:
     headings:
-      - content: >-
-          Send a fresh DB backup to every Telegram chat configured as an admin
+      - content: Send a fresh DB backup to every Telegram chat configured as an admin
           recipient. No body, no params.
-        id: >-
-          send-a-fresh-db-backup-to-every-telegram-chat-configured-as-an-admin-recipient-no-body-no-params
+        id: send-a-fresh-db-backup-to-every-telegram-chat-configured-as-an-admin-recipient-no-body-no-params
     contents: []
 ---
 

+ 195 - 346
docs/content/docs/en/reference/api/clients.mdx

@@ -1,195 +1,150 @@
 ---
 title: Clients
-description: >-
-  Manage clients as first-class entities that can be attached to one or more
-  inbounds. A single client row drives the settings.clients entry in every
-  inbound it belongs to. Endpoints live under /panel/api/clients.
+description: Manage clients as first-class entities that can be attached to one
+  or more inbounds. A single client row drives the settings.clients entry in
+  every inbound it belongs to. Endpoints live under /panel/api/clients.
 full: true
 _openapi:
   preload:
     - ./public/openapi.json
   toc:
     - depth: 2
-      title: >-
-        List every client with its attached inbound IDs and traffic record. The
+      title: List every client with its attached inbound IDs and traffic record. The
         reverse field, if set, is returned as a nested JSON object (legacy
         JSON-encoded-string form is still accepted on write).
-      url: >-
-        #list-every-client-with-its-attached-inbound-ids-and-traffic-record-the-reverse-field-if-set-is-returned-as-a-nested-json-object-legacy-json-encoded-string-form-is-still-accepted-on-write
-    - depth: 2
-      title: >-
-        Filter, sort, and paginate clients on the server. Each item is a slim
-        row (no uuid/password/auth/flow/security/reverse/tgId) so the clients
-        page can ship 25-ish rows in a few KB instead of the full table. The
-        response also includes a summary computed across the full DB row set so
-        dashboard counters stay stable as the user paginates or filters. Page
-        size capped at 200; fetch /get/:email to obtain the full per-client
-        payload for an edit/info modal.
-      url: >-
-        #filter-sort-and-paginate-clients-on-the-server-each-item-is-a-slim-row-no-uuidpasswordauthflowsecurityreversetgid-so-the-clients-page-can-ship-25-ish-rows-in-a-few-kb-instead-of-the-full-table-the-response-also-includes-a-summary-computed-across-the-full-db-row-set-so-dashboard-counters-stay-stable-as-the-user-paginates-or-filters-page-size-capped-at-200-fetch-getemail-to-obtain-the-full-per-client-payload-for-an-editinfo-modal
-    - depth: 2
-      title: >-
-        Fetch one client by email, including the inbound IDs and external config
+      url: '#list-every-client-with-its-attached-inbound-ids-and-traffic-record-the-reverse-field-if-set-is-returned-as-a-nested-json-object-legacy-json-encoded-string-form-is-still-accepted-on-write'
+    - depth: 2
+      title: Filter, sort, and paginate clients on the server. Each item is a slim row
+        (no uuid/password/auth/flow/security/reverse/tgId) so the clients page
+        can ship 25-ish rows in a few KB instead of the full table. The response
+        also includes a summary computed across the full DB row set so dashboard
+        counters stay stable as the user paginates or filters. Page size capped
+        at 200; fetch /get/:email to obtain the full per-client payload for an
+        edit/info modal.
+      url: '#filter-sort-and-paginate-clients-on-the-server-each-item-is-a-slim-row-no-uuidpasswordauthflowsecurityreversetgid-so-the-clients-page-can-ship-25-ish-rows-in-a-few-kb-instead-of-the-full-table-the-response-also-includes-a-summary-computed-across-the-full-db-row-set-so-dashboard-counters-stay-stable-as-the-user-paginates-or-filters-page-size-capped-at-200-fetch-getemail-to-obtain-the-full-per-client-payload-for-an-editinfo-modal'
+    - depth: 2
+      title: Fetch one client by email, including the inbound IDs and external config
         IDs it is attached to.
-      url: >-
-        #fetch-one-client-by-email-including-the-inbound-ids-and-external-config-ids-it-is-attached-to
+      url: '#fetch-one-client-by-email-including-the-inbound-ids-and-external-config-ids-it-is-attached-to'
     - depth: 2
-      title: >-
-        Create a new client and attach it to one or more inbounds in a single
+      title: Create a new client and attach it to one or more inbounds in a single
         call. Body is JSON. Per-protocol secrets (UUID for VLESS/VMess, password
         for Trojan/Shadowsocks, auth for Hysteria) are generated server-side
         when omitted, so callers can send only the universal fields.
-      url: >-
-        #create-a-new-client-and-attach-it-to-one-or-more-inbounds-in-a-single-call-body-is-json-per-protocol-secrets-uuid-for-vlessvmess-password-for-trojanshadowsocks-auth-for-hysteria-are-generated-server-side-when-omitted-so-callers-can-send-only-the-universal-fields
+      url: '#create-a-new-client-and-attach-it-to-one-or-more-inbounds-in-a-single-call-body-is-json-per-protocol-secrets-uuid-for-vlessvmess-password-for-trojanshadowsocks-auth-for-hysteria-are-generated-server-side-when-omitted-so-callers-can-send-only-the-universal-fields'
     - depth: 2
-      title: >-
-        Update an existing client by email. Changes propagate to every attached
+      title: Update an existing client by email. Changes propagate to every attached
         inbound. Body is the JSON client payload — supply the full set of fields
         you want to keep (the server replaces the row, it does not patch).
-      url: >-
-        #update-an-existing-client-by-email-changes-propagate-to-every-attached-inbound-body-is-the-json-client-payload--supply-the-full-set-of-fields-you-want-to-keep-the-server-replaces-the-row-it-does-not-patch
+      url: '#update-an-existing-client-by-email-changes-propagate-to-every-attached-inbound-body-is-the-json-client-payload--supply-the-full-set-of-fields-you-want-to-keep-the-server-replaces-the-row-it-does-not-patch'
     - depth: 2
-      title: >-
-        Delete a client by email. Removes it from every attached inbound and
+      title: Delete a client by email. Removes it from every attached inbound and
         drops its traffic record unless keepTraffic=1 is passed.
-      url: >-
-        #delete-a-client-by-email-removes-it-from-every-attached-inbound-and-drops-its-traffic-record-unless-keeptraffic1-is-passed
+      url: '#delete-a-client-by-email-removes-it-from-every-attached-inbound-and-drops-its-traffic-record-unless-keeptraffic1-is-passed'
     - depth: 2
-      title: >-
-        Attach an existing client to one or more additional inbounds. Body is
+      title: Attach an existing client to one or more additional inbounds. Body is
         JSON.
-      url: >-
-        #attach-an-existing-client-to-one-or-more-additional-inbounds-body-is-json
+      url: '#attach-an-existing-client-to-one-or-more-additional-inbounds-body-is-json'
     - depth: 2
       title: Detach a client from one or more inbounds without deleting the client.
       url: '#detach-a-client-from-one-or-more-inbounds-without-deleting-the-client'
     - depth: 2
-      title: >-
-        Replace a client's external links (per-client share links and remote
+      title: Replace a client's external links (per-client share links and remote
         subscription URLs surfaced in their subscription). Sends the full set;
         the server replaces all rows.
-      url: >-
-        #replace-a-clients-external-links-per-client-share-links-and-remote-subscription-urls-surfaced-in-their-subscription-sends-the-full-set-the-server-replaces-all-rows
+      url: '#replace-a-clients-external-links-per-client-share-links-and-remote-subscription-urls-surfaced-in-their-subscription-sends-the-full-set-the-server-replaces-all-rows'
     - depth: 2
-      title: >-
-        Reset the up/down counters for every client globally. Quotas and expiry
+      title: Reset the up/down counters for every client globally. Quotas and expiry
         are not affected. Triggers an Xray restart if any counter actually
         moved.
-      url: >-
-        #reset-the-updown-counters-for-every-client-globally-quotas-and-expiry-are-not-affected-triggers-an-xray-restart-if-any-counter-actually-moved
-    - depth: 2
-      title: >-
-        Delete every client whose traffic quota is exhausted (used >= total,
-        when reset is disabled) or whose expiry has passed. Returns the deleted
-        count and triggers an Xray restart when any client was on a running
-        inbound.
-      url: >-
-        #delete-every-client-whose-traffic-quota-is-exhausted-used--total-when-reset-is-disabled-or-whose-expiry-has-passed-returns-the-deleted-count-and-triggers-an-xray-restart-when-any-client-was-on-a-running-inbound
-    - depth: 2
-      title: >-
-        Delete every client that is not attached to any inbound, along with its
+      url: '#reset-the-updown-counters-for-every-client-globally-quotas-and-expiry-are-not-affected-triggers-an-xray-restart-if-any-counter-actually-moved'
+    - depth: 2
+      title: Delete every client whose traffic quota is exhausted (used >= total, when
+        reset is disabled) or whose expiry has passed. Returns the deleted count
+        and triggers an Xray restart when any client was on a running inbound.
+      url: '#delete-every-client-whose-traffic-quota-is-exhausted-used--total-when-reset-is-disabled-or-whose-expiry-has-passed-returns-the-deleted-count-and-triggers-an-xray-restart-when-any-client-was-on-a-running-inbound'
+    - depth: 2
+      title: Delete every client that is not attached to any inbound, along with its
         traffic record, IP log, and external links. Useful for clearing clients
         left unattached after their inbounds were removed. Returns the deleted
         count. Cannot be undone.
-      url: >-
-        #delete-every-client-that-is-not-attached-to-any-inbound-along-with-its-traffic-record-ip-log-and-external-links-useful-for-clearing-clients-left-unattached-after-their-inbounds-were-removed-returns-the-deleted-count-cannot-be-undone
+      url: '#delete-every-client-that-is-not-attached-to-any-inbound-along-with-its-traffic-record-ip-log-and-external-links-useful-for-clearing-clients-left-unattached-after-their-inbounds-were-removed-returns-the-deleted-count-cannot-be-undone'
     - depth: 2
-      title: >-
-        Return every client as a {client, inboundIds} array — the same shape
+      title: Return every client as a {client, inboundIds} array — the same shape
         /bulkCreate and /import accept — so the payload round-trips straight
         back through /import. Clients with no inbound attachment are included
         with an empty inboundIds list. The UI shows this in a CodeMirror viewer
         (copy / download); programmatic callers get the array in obj.
-      url: >-
-        #return-every-client-as-a-client-inboundids-array--the-same-shape-bulkcreate-and-import-accept--so-the-payload-round-trips-straight-back-through-import-clients-with-no-inbound-attachment-are-included-with-an-empty-inboundids-list-the-ui-shows-this-in-a-codemirror-viewer-copy--download-programmatic-callers-get-the-array-in-obj
+      url: '#return-every-client-as-a-client-inboundids-array--the-same-shape-bulkcreate-and-import-accept--so-the-payload-round-trips-straight-back-through-import-clients-with-no-inbound-attachment-are-included-with-an-empty-inboundids-list-the-ui-shows-this-in-a-codemirror-viewer-copy--download-programmatic-callers-get-the-array-in-obj'
     - depth: 2
-      title: >-
-        Import clients from a JSON body { "data": "<json>" }, where data is a
+      title: 'Import clients from a JSON body { "data": "<json>" }, where data is a
         string-encoded array produced by /export ([{client, inboundIds}]). Items
         with inboundIds are created and attached to those inbounds; items with
         an empty inboundIds list are restored as unattached client records.
         Existing emails are never overwritten — they are returned in skipped.
         Triggers a single Xray restart at the end if any target inbound was
-        running.
-      url: >-
-        #import-clients-from-a-json-body--data-json--where-data-is-a-string-encoded-array-produced-by-export-client-inboundids-items-with-inboundids-are-created-and-attached-to-those-inbounds-items-with-an-empty-inboundids-list-are-restored-as-unattached-client-records-existing-emails-are-never-overwritten--they-are-returned-in-skipped-triggers-a-single-xray-restart-at-the-end-if-any-target-inbound-was-running
+        running.'
+      url: '#import-clients-from-a-json-body--data-json--where-data-is-a-string-encoded-array-produced-by-export-client-inboundids-items-with-inboundids-are-created-and-attached-to-those-inbounds-items-with-an-empty-inboundids-list-are-restored-as-unattached-client-records-existing-emails-are-never-overwritten--they-are-returned-in-skipped-triggers-a-single-xray-restart-at-the-end-if-any-target-inbound-was-running'
     - depth: 2
-      title: >-
-        Shift expiry and/or traffic quota for many clients in one call.
+      title: 'Shift expiry and/or traffic quota for many clients in one call.
         addDays/addBytes may be negative. Clients with unlimited expiry
         (expiryTime=0) or unlimited traffic (totalGB=0) are skipped for the
         corresponding field — bulk extend never converts unlimited to limited.
         The optional flow directive sets the XTLS flow on every client: "none"
         clears it, "xtls-rprx-vision"/"xtls-rprx-vision-udp443" set it where the
         inbound supports it (omit or "" to leave it unchanged). Returns the
-        adjusted count and per-email skip reasons.
-      url: >-
-        #shift-expiry-andor-traffic-quota-for-many-clients-in-one-call-adddaysaddbytes-may-be-negative-clients-with-unlimited-expiry-expirytime0-or-unlimited-traffic-totalgb0-are-skipped-for-the-corresponding-field--bulk-extend-never-converts-unlimited-to-limited-the-optional-flow-directive-sets-the-xtls-flow-on-every-client-none-clears-it-xtls-rprx-visionxtls-rprx-vision-udp443-set-it-where-the-inbound-supports-it-omit-or--to-leave-it-unchanged-returns-the-adjusted-count-and-per-email-skip-reasons
+        adjusted count and per-email skip reasons.'
+      url: '#shift-expiry-andor-traffic-quota-for-many-clients-in-one-call-adddaysaddbytes-may-be-negative-clients-with-unlimited-expiry-expirytime0-or-unlimited-traffic-totalgb0-are-skipped-for-the-corresponding-field--bulk-extend-never-converts-unlimited-to-limited-the-optional-flow-directive-sets-the-xtls-flow-on-every-client-none-clears-it-xtls-rprx-visionxtls-rprx-vision-udp443-set-it-where-the-inbound-supports-it-omit-or--to-leave-it-unchanged-returns-the-adjusted-count-and-per-email-skip-reasons'
     - depth: 2
-      title: >-
-        Enable many clients in one call. Emails are grouped by inbound and
+      title: Enable many clients in one call. Emails are grouped by inbound and
         applied with a single read-modify-write per inbound; the running Xray
         (local or remote node) is updated to add each user. Note that enabling a
         client whose quota is exhausted or whose expiry has passed only flips
         the flag — the traffic loop will disable it again on the next tick.
         Returns the changed count and per-email skip reasons.
-      url: >-
-        #enable-many-clients-in-one-call-emails-are-grouped-by-inbound-and-applied-with-a-single-read-modify-write-per-inbound-the-running-xray-local-or-remote-node-is-updated-to-add-each-user-note-that-enabling-a-client-whose-quota-is-exhausted-or-whose-expiry-has-passed-only-flips-the-flag--the-traffic-loop-will-disable-it-again-on-the-next-tick-returns-the-changed-count-and-per-email-skip-reasons
+      url: '#enable-many-clients-in-one-call-emails-are-grouped-by-inbound-and-applied-with-a-single-read-modify-write-per-inbound-the-running-xray-local-or-remote-node-is-updated-to-add-each-user-note-that-enabling-a-client-whose-quota-is-exhausted-or-whose-expiry-has-passed-only-flips-the-flag--the-traffic-loop-will-disable-it-again-on-the-next-tick-returns-the-changed-count-and-per-email-skip-reasons'
     - depth: 2
-      title: >-
-        Disable many clients in one call. Emails are grouped by inbound and
+      title: Disable many clients in one call. Emails are grouped by inbound and
         applied with a single read-modify-write per inbound; the running Xray
         (local or remote node) is updated to remove each user. Returns the
         changed count and per-email skip reasons.
-      url: >-
-        #disable-many-clients-in-one-call-emails-are-grouped-by-inbound-and-applied-with-a-single-read-modify-write-per-inbound-the-running-xray-local-or-remote-node-is-updated-to-remove-each-user-returns-the-changed-count-and-per-email-skip-reasons
+      url: '#disable-many-clients-in-one-call-emails-are-grouped-by-inbound-and-applied-with-a-single-read-modify-write-per-inbound-the-running-xray-local-or-remote-node-is-updated-to-remove-each-user-returns-the-changed-count-and-per-email-skip-reasons'
     - depth: 2
-      title: >-
-        Delete many clients in one call. The server processes the list
+      title: Delete many clients in one call. The server processes the list
         sequentially so each delete sees the committed state of the previous one
         — avoids the race the per-email fan-out had on the panel side. Pass
         keepTraffic=true to retain the xray_client_traffic rows after deletion.
-      url: >-
-        #delete-many-clients-in-one-call-the-server-processes-the-list-sequentially-so-each-delete-sees-the-committed-state-of-the-previous-one--avoids-the-race-the-per-email-fan-out-had-on-the-panel-side-pass-keeptraffictrue-to-retain-the-xray_client_traffic-rows-after-deletion
+      url: '#delete-many-clients-in-one-call-the-server-processes-the-list-sequentially-so-each-delete-sees-the-committed-state-of-the-previous-one--avoids-the-race-the-per-email-fan-out-had-on-the-panel-side-pass-keeptraffictrue-to-retain-the-xray_client_traffic-rows-after-deletion'
     - depth: 2
-      title: >-
-        Create many clients in one call. Body is a JSON array of {client,
+      title: Create many clients in one call. Body is a JSON array of {client,
         inboundIds} payloads — the same shape /add accepts. Items are processed
         sequentially; per-email skip reasons are returned for items that fail
         (e.g., duplicate email). Triggers a single Xray restart at the end if
         any inbound was running.
-      url: >-
-        #create-many-clients-in-one-call-body-is-a-json-array-of-client-inboundids-payloads--the-same-shape-add-accepts-items-are-processed-sequentially-per-email-skip-reasons-are-returned-for-items-that-fail-eg-duplicate-email-triggers-a-single-xray-restart-at-the-end-if-any-inbound-was-running
+      url: '#create-many-clients-in-one-call-body-is-a-json-array-of-client-inboundids-payloads--the-same-shape-add-accepts-items-are-processed-sequentially-per-email-skip-reasons-are-returned-for-items-that-fail-eg-duplicate-email-triggers-a-single-xray-restart-at-the-end-if-any-inbound-was-running'
     - depth: 2
-      title: >-
-        Add many clients to a group in one call. Updates clients.group_name and
+      title: Add many clients to a group in one call. Updates clients.group_name and
         patches the matching client entry inside every owning inbound's settings
         JSON in a single transaction. If the group name does not yet exist (in
         client_groups or as a derived label), it is auto-created as a persistent
         group. To clear the group label, use /groups/bulkRemove instead.
-      url: >-
-        #add-many-clients-to-a-group-in-one-call-updates-clientsgroup_name-and-patches-the-matching-client-entry-inside-every-owning-inbounds-settings-json-in-a-single-transaction-if-the-group-name-does-not-yet-exist-in-client_groups-or-as-a-derived-label-it-is-auto-created-as-a-persistent-group-to-clear-the-group-label-use-groupsbulkremove-instead
+      url: '#add-many-clients-to-a-group-in-one-call-updates-clientsgroup_name-and-patches-the-matching-client-entry-inside-every-owning-inbounds-settings-json-in-a-single-transaction-if-the-group-name-does-not-yet-exist-in-client_groups-or-as-a-derived-label-it-is-auto-created-as-a-persistent-group-to-clear-the-group-label-use-groupsbulkremove-instead'
     - depth: 2
-      title: >-
-        Clear the group label on many clients in one call. Inverse of
+      title: Clear the group label on many clients in one call. Inverse of
         /groups/bulkAdd. Clients themselves are kept — only the group label is
         cleared from clients.group_name and from each owning inbound's settings
         JSON. Groups become empty if all their members are removed.
-      url: >-
-        #clear-the-group-label-on-many-clients-in-one-call-inverse-of-groupsbulkadd-clients-themselves-are-kept--only-the-group-label-is-cleared-from-clientsgroup_name-and-from-each-owning-inbounds-settings-json-groups-become-empty-if-all-their-members-are-removed
+      url: '#clear-the-group-label-on-many-clients-in-one-call-inverse-of-groupsbulkadd-clients-themselves-are-kept--only-the-group-label-is-cleared-from-clientsgroup_name-and-from-each-owning-inbounds-settings-json-groups-become-empty-if-all-their-members-are-removed'
     - depth: 2
-      title: >-
-        Attach many existing clients to many inbounds in one call. Each client
+      title: Attach many existing clients to many inbounds in one call. Each client
         keeps its identity (email/UUID/password/subId) and a shared traffic row;
         all clients are added to a target inbound in a single AddInboundClient
         call. Clients already present on a target are reported under skipped.
         Returns per-email attached/skipped/errors lists and triggers a single
         Xray restart if any target inbound was running.
-      url: >-
-        #attach-many-existing-clients-to-many-inbounds-in-one-call-each-client-keeps-its-identity-emailuuidpasswordsubid-and-a-shared-traffic-row-all-clients-are-added-to-a-target-inbound-in-a-single-addinboundclient-call-clients-already-present-on-a-target-are-reported-under-skipped-returns-per-email-attachedskippederrors-lists-and-triggers-a-single-xray-restart-if-any-target-inbound-was-running
+      url: '#attach-many-existing-clients-to-many-inbounds-in-one-call-each-client-keeps-its-identity-emailuuidpasswordsubid-and-a-shared-traffic-row-all-clients-are-added-to-a-target-inbound-in-a-single-addinboundclient-call-clients-already-present-on-a-target-are-reported-under-skipped-returns-per-email-attachedskippederrors-lists-and-triggers-a-single-xray-restart-if-any-target-inbound-was-running'
     - depth: 2
-      title: >-
-        Mirror of bulkAttach: detach many existing clients from many inbounds in
+      title: "Mirror of bulkAttach: detach many existing clients from many inbounds in
         one call. For each email, intersects the client's current inbounds with
         the requested set and detaches from those only; (email, inbound) pairs
         where the client is not currently attached are silently no-ops. Emails
@@ -197,110 +152,82 @@ _openapi:
         skipped. Client records are kept even if they become orphaned — use
         bulkDel for full removal. Returns per-email detached/skipped/errors
         lists and triggers a single Xray restart if any target inbound was
-        running.
-      url: >-
-        #mirror-of-bulkattach-detach-many-existing-clients-from-many-inbounds-in-one-call-for-each-email-intersects-the-clients-current-inbounds-with-the-requested-set-and-detaches-from-those-only-email-inbound-pairs-where-the-client-is-not-currently-attached-are-silently-no-ops-emails-not-attached-to-any-of-the-requested-inbounds-are-reported-under-skipped-client-records-are-kept-even-if-they-become-orphaned--use-bulkdel-for-full-removal-returns-per-email-detachedskippederrors-lists-and-triggers-a-single-xray-restart-if-any-target-inbound-was-running
+        running."
+      url: '#mirror-of-bulkattach-detach-many-existing-clients-from-many-inbounds-in-one-call-for-each-email-intersects-the-clients-current-inbounds-with-the-requested-set-and-detaches-from-those-only-email-inbound-pairs-where-the-client-is-not-currently-attached-are-silently-no-ops-emails-not-attached-to-any-of-the-requested-inbounds-are-reported-under-skipped-client-records-are-kept-even-if-they-become-orphaned--use-bulkdel-for-full-removal-returns-per-email-detachedskippederrors-lists-and-triggers-a-single-xray-restart-if-any-target-inbound-was-running'
     - depth: 2
-      title: >-
-        Zero up/down counters for many clients in one call. Loops the
+      title: Zero up/down counters for many clients in one call. Loops the
         single-reset path so each client is re-enabled across its attached
         inbounds and pushed to Xray/remote nodes. Returns the count of
         successfully reset clients.
-      url: >-
-        #zero-updown-counters-for-many-clients-in-one-call-loops-the-single-reset-path-so-each-client-is-re-enabled-across-its-attached-inbounds-and-pushed-to-xrayremote-nodes-returns-the-count-of-successfully-reset-clients
+      url: '#zero-updown-counters-for-many-clients-in-one-call-loops-the-single-reset-path-so-each-client-is-re-enabled-across-its-attached-inbounds-and-pushed-to-xrayremote-nodes-returns-the-count-of-successfully-reset-clients'
     - depth: 2
-      title: >-
-        List all client groups with their member counts. Merges persisted groups
+      title: List all client groups with their member counts. Merges persisted groups
         (rows in client_groups, including empty placeholders) with the distinct
         group_name values currently set on clients. Sorted alphabetically
         (case-insensitive).
-      url: >-
-        #list-all-client-groups-with-their-member-counts-merges-persisted-groups-rows-in-client_groups-including-empty-placeholders-with-the-distinct-group_name-values-currently-set-on-clients-sorted-alphabetically-case-insensitive
+      url: '#list-all-client-groups-with-their-member-counts-merges-persisted-groups-rows-in-client_groups-including-empty-placeholders-with-the-distinct-group_name-values-currently-set-on-clients-sorted-alphabetically-case-insensitive'
     - depth: 2
-      title: >-
-        Return just the email list of clients that currently belong to the given
+      title: Return just the email list of clients that currently belong to the given
         group. Useful for fanning a single bulk action over an entire group
         without round-tripping the full client list.
-      url: >-
-        #return-just-the-email-list-of-clients-that-currently-belong-to-the-given-group-useful-for-fanning-a-single-bulk-action-over-an-entire-group-without-round-tripping-the-full-client-list
+      url: '#return-just-the-email-list-of-clients-that-currently-belong-to-the-given-group-useful-for-fanning-a-single-bulk-action-over-an-entire-group-without-round-tripping-the-full-client-list'
     - depth: 2
-      title: >-
-        Create a new empty (placeholder) group. The group becomes selectable in
+      title: Create a new empty (placeholder) group. The group becomes selectable in
         client forms and the filter drawer even before any client is added to
         it. Errors if a group with the same name already exists.
-      url: >-
-        #create-a-new-empty-placeholder-group-the-group-becomes-selectable-in-client-forms-and-the-filter-drawer-even-before-any-client-is-added-to-it-errors-if-a-group-with-the-same-name-already-exists
+      url: '#create-a-new-empty-placeholder-group-the-group-becomes-selectable-in-client-forms-and-the-filter-drawer-even-before-any-client-is-added-to-it-errors-if-a-group-with-the-same-name-already-exists'
     - depth: 2
-      title: >-
-        Rename a group. The new name is applied to the client_groups row AND
+      title: Rename a group. The new name is applied to the client_groups row AND
         propagated to every matching client (both clients.group_name and the
         client entry inside every owning inbound's settings JSON) in a single
         transaction. Returns the number of clients whose label was updated.
-      url: >-
-        #rename-a-group-the-new-name-is-applied-to-the-client_groups-row-and-propagated-to-every-matching-client-both-clientsgroup_name-and-the-client-entry-inside-every-owning-inbounds-settings-json-in-a-single-transaction-returns-the-number-of-clients-whose-label-was-updated
+      url: '#rename-a-group-the-new-name-is-applied-to-the-client_groups-row-and-propagated-to-every-matching-client-both-clientsgroup_name-and-the-client-entry-inside-every-owning-inbounds-settings-json-in-a-single-transaction-returns-the-number-of-clients-whose-label-was-updated'
     - depth: 2
-      title: >-
-        Remove a group. Deletes the client_groups row and clears the group label
+      title: Remove a group. Deletes the client_groups row and clears the group label
         from every matching client (both clients.group_name and the inbound
         settings JSON). The clients themselves are NOT deleted — use /bulkDel
         after filtering by group for that. Returns the count of clients whose
         label was cleared.
-      url: >-
-        #remove-a-group-deletes-the-client_groups-row-and-clears-the-group-label-from-every-matching-client-both-clientsgroup_name-and-the-inbound-settings-json-the-clients-themselves-are-not-deleted--use-bulkdel-after-filtering-by-group-for-that-returns-the-count-of-clients-whose-label-was-cleared
-    - depth: 2
-      title: >-
-        Zero out a single client’s up/down counters. Re-enables the client
-        across every attached inbound and pushes the change to Xray (or the
-        remote node) so depleted users can connect again immediately.
-      url: >-
-        #zero-out-a-single-clients-updown-counters-re-enables-the-client-across-every-attached-inbound-and-pushes-the-change-to-xray-or-the-remote-node-so-depleted-users-can-connect-again-immediately
-    - depth: 2
-      title: >-
-        Manually adjust a client’s upload + download counters. Useful for
+      url: '#remove-a-group-deletes-the-client_groups-row-and-clears-the-group-label-from-every-matching-client-both-clientsgroup_name-and-the-inbound-settings-json-the-clients-themselves-are-not-deleted--use-bulkdel-after-filtering-by-group-for-that-returns-the-count-of-clients-whose-label-was-cleared'
+    - depth: 2
+      title: Zero out a single client’s up/down counters. Re-enables the client across
+        every attached inbound and pushes the change to Xray (or the remote
+        node) so depleted users can connect again immediately.
+      url: '#zero-out-a-single-clients-updown-counters-re-enables-the-client-across-every-attached-inbound-and-pushes-the-change-to-xray-or-the-remote-node-so-depleted-users-can-connect-again-immediately'
+    - depth: 2
+      title: Manually adjust a client’s upload + download counters. Useful for
         migrations from external accounting systems.
-      url: >-
-        #manually-adjust-a-clients-upload--download-counters-useful-for-migrations-from-external-accounting-systems
+      url: '#manually-adjust-a-clients-upload--download-counters-useful-for-migrations-from-external-accounting-systems'
     - depth: 2
-      title: >-
-        List source IPs that have connected with the given client’s credentials.
+      title: List source IPs that have connected with the given client’s credentials.
         Returns an array of "ip (timestamp)" strings.
-      url: >-
-        #list-source-ips-that-have-connected-with-the-given-clients-credentials-returns-an-array-of-ip-timestamp-strings
+      url: '#list-source-ips-that-have-connected-with-the-given-clients-credentials-returns-an-array-of-ip-timestamp-strings'
     - depth: 2
       title: Reset the recorded IP list for a client.
       url: '#reset-the-recorded-ip-list-for-a-client'
     - depth: 2
-      title: >-
-        List the emails of currently connected clients (last seen within the
+      title: List the emails of currently connected clients (last seen within the
         heartbeat window), deduped across every node.
-      url: >-
-        #list-the-emails-of-currently-connected-clients-last-seen-within-the-heartbeat-window-deduped-across-every-node
-    - depth: 2
-      title: >-
-        Online client emails grouped by the panelGuid of the node that
-        physically hosts each client. The local panel uses its own GUID; each
-        node (at any depth in a chain) uses its GUID. Lets the inbounds page
-        attribute online status to the real node instead of the intermediate one
-        it syncs through.
-      url: >-
-        #online-client-emails-grouped-by-the-panelguid-of-the-node-that-physically-hosts-each-client-the-local-panel-uses-its-own-guid-each-node-at-any-depth-in-a-chain-uses-its-guid-lets-the-inbounds-page-attribute-online-status-to-the-real-node-instead-of-the-intermediate-one-it-syncs-through
-    - depth: 2
-      title: >-
-        Per-client source IPs grouped by the panelGuid of the node that observed
+      url: '#list-the-emails-of-currently-connected-clients-last-seen-within-the-heartbeat-window-deduped-across-every-node'
+    - depth: 2
+      title: Online client emails grouped by the panelGuid of the node that physically
+        hosts each client. The local panel uses its own GUID; each node (at any
+        depth in a chain) uses its GUID. Lets the inbounds page attribute online
+        status to the real node instead of the intermediate one it syncs
+        through.
+      url: '#online-client-emails-grouped-by-the-panelguid-of-the-node-that-physically-hosts-each-client-the-local-panel-uses-its-own-guid-each-node-at-any-depth-in-a-chain-uses-its-guid-lets-the-inbounds-page-attribute-online-status-to-the-real-node-instead-of-the-intermediate-one-it-syncs-through'
+    - depth: 2
+      title: Per-client source IPs grouped by the panelGuid of the node that observed
         them. Lets the central panel attribute and enforce per-client IP limits
         using the real visitor IPs each node sees, instead of the address of the
         intermediate panel it syncs through.
-      url: >-
-        #per-client-source-ips-grouped-by-the-panelguid-of-the-node-that-observed-them-lets-the-central-panel-attribute-and-enforce-per-client-ip-limits-using-the-real-visitor-ips-each-node-sees-instead-of-the-address-of-the-intermediate-panel-it-syncs-through
-    - depth: 2
-      title: >-
-        Inbound tags that carried traffic within the heartbeat window, grouped
-        by the hosting node's panelGuid. Pairs with onlinesByGuid so the
-        inbounds page only marks a multi-inbound client online on the inbounds
-        it actually used. Nodes that do not report per-inbound activity are
-        absent.
-      url: >-
-        #inbound-tags-that-carried-traffic-within-the-heartbeat-window-grouped-by-the-hosting-nodes-panelguid-pairs-with-onlinesbyguid-so-the-inbounds-page-only-marks-a-multi-inbound-client-online-on-the-inbounds-it-actually-used-nodes-that-do-not-report-per-inbound-activity-are-absent
+      url: '#per-client-source-ips-grouped-by-the-panelguid-of-the-node-that-observed-them-lets-the-central-panel-attribute-and-enforce-per-client-ip-limits-using-the-real-visitor-ips-each-node-sees-instead-of-the-address-of-the-intermediate-panel-it-syncs-through'
+    - depth: 2
+      title: Inbound tags that carried traffic within the heartbeat window, grouped by
+        the hosting node's panelGuid. Pairs with onlinesByGuid so the inbounds
+        page only marks a multi-inbound client online on the inbounds it
+        actually used. Nodes that do not report per-inbound activity are absent.
+      url: '#inbound-tags-that-carried-traffic-within-the-heartbeat-window-grouped-by-the-hosting-nodes-panelguid-pairs-with-onlinesbyguid-so-the-inbounds-page-only-marks-a-multi-inbound-client-online-on-the-inbounds-it-actually-used-nodes-that-do-not-report-per-inbound-activity-are-absent'
     - depth: 2
       title: Map of client email → last-seen unix timestamp.
       url: '#map-of-client-email--last-seen-unix-timestamp'
@@ -308,189 +235,142 @@ _openapi:
       title: Traffic counters for a client identified by email.
       url: '#traffic-counters-for-a-client-identified-by-email'
     - depth: 2
-      title: >-
-        Return every protocol URL (vless://, vmess://, trojan://, ss://,
+      title: Return every protocol URL (vless://, vmess://, trojan://, ss://,
         hysteria://, hy2://) for clients matching the subscription ID. Same
         result set as /sub/<subId>, but as a JSON array — no base64. When an
         inbound has streamSettings.externalProxy set, one URL is emitted per
         external proxy. Empty array when the subId has no enabled clients.
-      url: >-
-        #return-every-protocol-url-vless-vmess-trojan-ss-hysteria-hy2-for-clients-matching-the-subscription-id-same-result-set-as-subsubid-but-as-a-json-array--no-base64-when-an-inbound-has-streamsettingsexternalproxy-set-one-url-is-emitted-per-external-proxy-empty-array-when-the-subid-has-no-enabled-clients
+      url: '#return-every-protocol-url-vless-vmess-trojan-ss-hysteria-hy2-for-clients-matching-the-subscription-id-same-result-set-as-subsubid-but-as-a-json-array--no-base64-when-an-inbound-has-streamsettingsexternalproxy-set-one-url-is-emitted-per-external-proxy-empty-array-when-the-subid-has-no-enabled-clients'
     - depth: 2
-      title: >-
-        Return every URL for one client across all attached inbounds — the same
+      title: 'Return every URL for one client across all attached inbounds — the same
         strings the Copy URL button copies in the panel UI. Supported protocols:
         vmess, vless, trojan, shadowsocks, hysteria. If
         streamSettings.externalProxy is set, returns one URL per external proxy.
         Protocols without a URL form (socks, http, mixed, wireguard, dokodemo,
-        tunnel) contribute nothing.
-      url: >-
-        #return-every-url-for-one-client-across-all-attached-inbounds--the-same-strings-the-copy-url-button-copies-in-the-panel-ui-supported-protocols-vmess-vless-trojan-shadowsocks-hysteria-if-streamsettingsexternalproxy-is-set-returns-one-url-per-external-proxy-protocols-without-a-url-form-socks-http-mixed-wireguard-dokodemo-tunnel-contribute-nothing
+        tunnel) contribute nothing.'
+      url: '#return-every-url-for-one-client-across-all-attached-inbounds--the-same-strings-the-copy-url-button-copies-in-the-panel-ui-supported-protocols-vmess-vless-trojan-shadowsocks-hysteria-if-streamsettingsexternalproxy-is-set-returns-one-url-per-external-proxy-protocols-without-a-url-form-socks-http-mixed-wireguard-dokodemo-tunnel-contribute-nothing'
   structuredData:
     headings:
-      - content: >-
-          List every client with its attached inbound IDs and traffic record.
-          The reverse field, if set, is returned as a nested JSON object (legacy
+      - content: List every client with its attached inbound IDs and traffic record. The
+          reverse field, if set, is returned as a nested JSON object (legacy
           JSON-encoded-string form is still accepted on write).
-        id: >-
-          list-every-client-with-its-attached-inbound-ids-and-traffic-record-the-reverse-field-if-set-is-returned-as-a-nested-json-object-legacy-json-encoded-string-form-is-still-accepted-on-write
-      - content: >-
-          Filter, sort, and paginate clients on the server. Each item is a slim
+        id: list-every-client-with-its-attached-inbound-ids-and-traffic-record-the-reverse-field-if-set-is-returned-as-a-nested-json-object-legacy-json-encoded-string-form-is-still-accepted-on-write
+      - content: Filter, sort, and paginate clients on the server. Each item is a slim
           row (no uuid/password/auth/flow/security/reverse/tgId) so the clients
           page can ship 25-ish rows in a few KB instead of the full table. The
           response also includes a summary computed across the full DB row set
           so dashboard counters stay stable as the user paginates or filters.
           Page size capped at 200; fetch /get/:email to obtain the full
           per-client payload for an edit/info modal.
-        id: >-
-          filter-sort-and-paginate-clients-on-the-server-each-item-is-a-slim-row-no-uuidpasswordauthflowsecurityreversetgid-so-the-clients-page-can-ship-25-ish-rows-in-a-few-kb-instead-of-the-full-table-the-response-also-includes-a-summary-computed-across-the-full-db-row-set-so-dashboard-counters-stay-stable-as-the-user-paginates-or-filters-page-size-capped-at-200-fetch-getemail-to-obtain-the-full-per-client-payload-for-an-editinfo-modal
-      - content: >-
-          Fetch one client by email, including the inbound IDs and external
+        id: filter-sort-and-paginate-clients-on-the-server-each-item-is-a-slim-row-no-uuidpasswordauthflowsecurityreversetgid-so-the-clients-page-can-ship-25-ish-rows-in-a-few-kb-instead-of-the-full-table-the-response-also-includes-a-summary-computed-across-the-full-db-row-set-so-dashboard-counters-stay-stable-as-the-user-paginates-or-filters-page-size-capped-at-200-fetch-getemail-to-obtain-the-full-per-client-payload-for-an-editinfo-modal
+      - content: Fetch one client by email, including the inbound IDs and external
           config IDs it is attached to.
-        id: >-
-          fetch-one-client-by-email-including-the-inbound-ids-and-external-config-ids-it-is-attached-to
-      - content: >-
-          Create a new client and attach it to one or more inbounds in a single
+        id: fetch-one-client-by-email-including-the-inbound-ids-and-external-config-ids-it-is-attached-to
+      - content: Create a new client and attach it to one or more inbounds in a single
           call. Body is JSON. Per-protocol secrets (UUID for VLESS/VMess,
           password for Trojan/Shadowsocks, auth for Hysteria) are generated
           server-side when omitted, so callers can send only the universal
           fields.
-        id: >-
-          create-a-new-client-and-attach-it-to-one-or-more-inbounds-in-a-single-call-body-is-json-per-protocol-secrets-uuid-for-vlessvmess-password-for-trojanshadowsocks-auth-for-hysteria-are-generated-server-side-when-omitted-so-callers-can-send-only-the-universal-fields
-      - content: >-
-          Update an existing client by email. Changes propagate to every
-          attached inbound. Body is the JSON client payload — supply the full
-          set of fields you want to keep (the server replaces the row, it does
-          not patch).
-        id: >-
-          update-an-existing-client-by-email-changes-propagate-to-every-attached-inbound-body-is-the-json-client-payload--supply-the-full-set-of-fields-you-want-to-keep-the-server-replaces-the-row-it-does-not-patch
-      - content: >-
-          Delete a client by email. Removes it from every attached inbound and
+        id: create-a-new-client-and-attach-it-to-one-or-more-inbounds-in-a-single-call-body-is-json-per-protocol-secrets-uuid-for-vlessvmess-password-for-trojanshadowsocks-auth-for-hysteria-are-generated-server-side-when-omitted-so-callers-can-send-only-the-universal-fields
+      - content: Update an existing client by email. Changes propagate to every attached
+          inbound. Body is the JSON client payload — supply the full set of
+          fields you want to keep (the server replaces the row, it does not
+          patch).
+        id: update-an-existing-client-by-email-changes-propagate-to-every-attached-inbound-body-is-the-json-client-payload--supply-the-full-set-of-fields-you-want-to-keep-the-server-replaces-the-row-it-does-not-patch
+      - content: Delete a client by email. Removes it from every attached inbound and
           drops its traffic record unless keepTraffic=1 is passed.
-        id: >-
-          delete-a-client-by-email-removes-it-from-every-attached-inbound-and-drops-its-traffic-record-unless-keeptraffic1-is-passed
-      - content: >-
-          Attach an existing client to one or more additional inbounds. Body is
+        id: delete-a-client-by-email-removes-it-from-every-attached-inbound-and-drops-its-traffic-record-unless-keeptraffic1-is-passed
+      - content: Attach an existing client to one or more additional inbounds. Body is
           JSON.
-        id: >-
-          attach-an-existing-client-to-one-or-more-additional-inbounds-body-is-json
+        id: attach-an-existing-client-to-one-or-more-additional-inbounds-body-is-json
       - content: Detach a client from one or more inbounds without deleting the client.
         id: detach-a-client-from-one-or-more-inbounds-without-deleting-the-client
-      - content: >-
-          Replace a client's external links (per-client share links and remote
+      - content: Replace a client's external links (per-client share links and remote
           subscription URLs surfaced in their subscription). Sends the full set;
           the server replaces all rows.
-        id: >-
-          replace-a-clients-external-links-per-client-share-links-and-remote-subscription-urls-surfaced-in-their-subscription-sends-the-full-set-the-server-replaces-all-rows
-      - content: >-
-          Reset the up/down counters for every client globally. Quotas and
-          expiry are not affected. Triggers an Xray restart if any counter
-          actually moved.
-        id: >-
-          reset-the-updown-counters-for-every-client-globally-quotas-and-expiry-are-not-affected-triggers-an-xray-restart-if-any-counter-actually-moved
-      - content: >-
-          Delete every client whose traffic quota is exhausted (used >= total,
+        id: replace-a-clients-external-links-per-client-share-links-and-remote-subscription-urls-surfaced-in-their-subscription-sends-the-full-set-the-server-replaces-all-rows
+      - content: Reset the up/down counters for every client globally. Quotas and expiry
+          are not affected. Triggers an Xray restart if any counter actually
+          moved.
+        id: reset-the-updown-counters-for-every-client-globally-quotas-and-expiry-are-not-affected-triggers-an-xray-restart-if-any-counter-actually-moved
+      - content: Delete every client whose traffic quota is exhausted (used >= total,
           when reset is disabled) or whose expiry has passed. Returns the
           deleted count and triggers an Xray restart when any client was on a
           running inbound.
-        id: >-
-          delete-every-client-whose-traffic-quota-is-exhausted-used--total-when-reset-is-disabled-or-whose-expiry-has-passed-returns-the-deleted-count-and-triggers-an-xray-restart-when-any-client-was-on-a-running-inbound
-      - content: >-
-          Delete every client that is not attached to any inbound, along with
-          its traffic record, IP log, and external links. Useful for clearing
+        id: delete-every-client-whose-traffic-quota-is-exhausted-used--total-when-reset-is-disabled-or-whose-expiry-has-passed-returns-the-deleted-count-and-triggers-an-xray-restart-when-any-client-was-on-a-running-inbound
+      - content: Delete every client that is not attached to any inbound, along with its
+          traffic record, IP log, and external links. Useful for clearing
           clients left unattached after their inbounds were removed. Returns the
           deleted count. Cannot be undone.
-        id: >-
-          delete-every-client-that-is-not-attached-to-any-inbound-along-with-its-traffic-record-ip-log-and-external-links-useful-for-clearing-clients-left-unattached-after-their-inbounds-were-removed-returns-the-deleted-count-cannot-be-undone
-      - content: >-
-          Return every client as a {client, inboundIds} array — the same shape
+        id: delete-every-client-that-is-not-attached-to-any-inbound-along-with-its-traffic-record-ip-log-and-external-links-useful-for-clearing-clients-left-unattached-after-their-inbounds-were-removed-returns-the-deleted-count-cannot-be-undone
+      - content: Return every client as a {client, inboundIds} array — the same shape
           /bulkCreate and /import accept — so the payload round-trips straight
           back through /import. Clients with no inbound attachment are included
           with an empty inboundIds list. The UI shows this in a CodeMirror
           viewer (copy / download); programmatic callers get the array in obj.
-        id: >-
-          return-every-client-as-a-client-inboundids-array--the-same-shape-bulkcreate-and-import-accept--so-the-payload-round-trips-straight-back-through-import-clients-with-no-inbound-attachment-are-included-with-an-empty-inboundids-list-the-ui-shows-this-in-a-codemirror-viewer-copy--download-programmatic-callers-get-the-array-in-obj
-      - content: >-
-          Import clients from a JSON body { "data": "<json>" }, where data is a
+        id: return-every-client-as-a-client-inboundids-array--the-same-shape-bulkcreate-and-import-accept--so-the-payload-round-trips-straight-back-through-import-clients-with-no-inbound-attachment-are-included-with-an-empty-inboundids-list-the-ui-shows-this-in-a-codemirror-viewer-copy--download-programmatic-callers-get-the-array-in-obj
+      - content: 'Import clients from a JSON body { "data": "<json>" }, where data is a
           string-encoded array produced by /export ([{client, inboundIds}]).
           Items with inboundIds are created and attached to those inbounds;
           items with an empty inboundIds list are restored as unattached client
           records. Existing emails are never overwritten — they are returned in
           skipped. Triggers a single Xray restart at the end if any target
-          inbound was running.
-        id: >-
-          import-clients-from-a-json-body--data-json--where-data-is-a-string-encoded-array-produced-by-export-client-inboundids-items-with-inboundids-are-created-and-attached-to-those-inbounds-items-with-an-empty-inboundids-list-are-restored-as-unattached-client-records-existing-emails-are-never-overwritten--they-are-returned-in-skipped-triggers-a-single-xray-restart-at-the-end-if-any-target-inbound-was-running
-      - content: >-
-          Shift expiry and/or traffic quota for many clients in one call.
+          inbound was running.'
+        id: import-clients-from-a-json-body--data-json--where-data-is-a-string-encoded-array-produced-by-export-client-inboundids-items-with-inboundids-are-created-and-attached-to-those-inbounds-items-with-an-empty-inboundids-list-are-restored-as-unattached-client-records-existing-emails-are-never-overwritten--they-are-returned-in-skipped-triggers-a-single-xray-restart-at-the-end-if-any-target-inbound-was-running
+      - content: 'Shift expiry and/or traffic quota for many clients in one call.
           addDays/addBytes may be negative. Clients with unlimited expiry
           (expiryTime=0) or unlimited traffic (totalGB=0) are skipped for the
           corresponding field — bulk extend never converts unlimited to limited.
           The optional flow directive sets the XTLS flow on every client: "none"
           clears it, "xtls-rprx-vision"/"xtls-rprx-vision-udp443" set it where
           the inbound supports it (omit or "" to leave it unchanged). Returns
-          the adjusted count and per-email skip reasons.
-        id: >-
-          shift-expiry-andor-traffic-quota-for-many-clients-in-one-call-adddaysaddbytes-may-be-negative-clients-with-unlimited-expiry-expirytime0-or-unlimited-traffic-totalgb0-are-skipped-for-the-corresponding-field--bulk-extend-never-converts-unlimited-to-limited-the-optional-flow-directive-sets-the-xtls-flow-on-every-client-none-clears-it-xtls-rprx-visionxtls-rprx-vision-udp443-set-it-where-the-inbound-supports-it-omit-or--to-leave-it-unchanged-returns-the-adjusted-count-and-per-email-skip-reasons
-      - content: >-
-          Enable many clients in one call. Emails are grouped by inbound and
+          the adjusted count and per-email skip reasons.'
+        id: shift-expiry-andor-traffic-quota-for-many-clients-in-one-call-adddaysaddbytes-may-be-negative-clients-with-unlimited-expiry-expirytime0-or-unlimited-traffic-totalgb0-are-skipped-for-the-corresponding-field--bulk-extend-never-converts-unlimited-to-limited-the-optional-flow-directive-sets-the-xtls-flow-on-every-client-none-clears-it-xtls-rprx-visionxtls-rprx-vision-udp443-set-it-where-the-inbound-supports-it-omit-or--to-leave-it-unchanged-returns-the-adjusted-count-and-per-email-skip-reasons
+      - content: Enable many clients in one call. Emails are grouped by inbound and
           applied with a single read-modify-write per inbound; the running Xray
           (local or remote node) is updated to add each user. Note that enabling
           a client whose quota is exhausted or whose expiry has passed only
           flips the flag — the traffic loop will disable it again on the next
           tick. Returns the changed count and per-email skip reasons.
-        id: >-
-          enable-many-clients-in-one-call-emails-are-grouped-by-inbound-and-applied-with-a-single-read-modify-write-per-inbound-the-running-xray-local-or-remote-node-is-updated-to-add-each-user-note-that-enabling-a-client-whose-quota-is-exhausted-or-whose-expiry-has-passed-only-flips-the-flag--the-traffic-loop-will-disable-it-again-on-the-next-tick-returns-the-changed-count-and-per-email-skip-reasons
-      - content: >-
-          Disable many clients in one call. Emails are grouped by inbound and
+        id: enable-many-clients-in-one-call-emails-are-grouped-by-inbound-and-applied-with-a-single-read-modify-write-per-inbound-the-running-xray-local-or-remote-node-is-updated-to-add-each-user-note-that-enabling-a-client-whose-quota-is-exhausted-or-whose-expiry-has-passed-only-flips-the-flag--the-traffic-loop-will-disable-it-again-on-the-next-tick-returns-the-changed-count-and-per-email-skip-reasons
+      - content: Disable many clients in one call. Emails are grouped by inbound and
           applied with a single read-modify-write per inbound; the running Xray
           (local or remote node) is updated to remove each user. Returns the
           changed count and per-email skip reasons.
-        id: >-
-          disable-many-clients-in-one-call-emails-are-grouped-by-inbound-and-applied-with-a-single-read-modify-write-per-inbound-the-running-xray-local-or-remote-node-is-updated-to-remove-each-user-returns-the-changed-count-and-per-email-skip-reasons
-      - content: >-
-          Delete many clients in one call. The server processes the list
+        id: disable-many-clients-in-one-call-emails-are-grouped-by-inbound-and-applied-with-a-single-read-modify-write-per-inbound-the-running-xray-local-or-remote-node-is-updated-to-remove-each-user-returns-the-changed-count-and-per-email-skip-reasons
+      - content: Delete many clients in one call. The server processes the list
           sequentially so each delete sees the committed state of the previous
           one — avoids the race the per-email fan-out had on the panel side.
           Pass keepTraffic=true to retain the xray_client_traffic rows after
           deletion.
-        id: >-
-          delete-many-clients-in-one-call-the-server-processes-the-list-sequentially-so-each-delete-sees-the-committed-state-of-the-previous-one--avoids-the-race-the-per-email-fan-out-had-on-the-panel-side-pass-keeptraffictrue-to-retain-the-xray_client_traffic-rows-after-deletion
-      - content: >-
-          Create many clients in one call. Body is a JSON array of {client,
+        id: delete-many-clients-in-one-call-the-server-processes-the-list-sequentially-so-each-delete-sees-the-committed-state-of-the-previous-one--avoids-the-race-the-per-email-fan-out-had-on-the-panel-side-pass-keeptraffictrue-to-retain-the-xray_client_traffic-rows-after-deletion
+      - content: Create many clients in one call. Body is a JSON array of {client,
           inboundIds} payloads — the same shape /add accepts. Items are
           processed sequentially; per-email skip reasons are returned for items
           that fail (e.g., duplicate email). Triggers a single Xray restart at
           the end if any inbound was running.
-        id: >-
-          create-many-clients-in-one-call-body-is-a-json-array-of-client-inboundids-payloads--the-same-shape-add-accepts-items-are-processed-sequentially-per-email-skip-reasons-are-returned-for-items-that-fail-eg-duplicate-email-triggers-a-single-xray-restart-at-the-end-if-any-inbound-was-running
-      - content: >-
-          Add many clients to a group in one call. Updates clients.group_name
-          and patches the matching client entry inside every owning inbound's
+        id: create-many-clients-in-one-call-body-is-a-json-array-of-client-inboundids-payloads--the-same-shape-add-accepts-items-are-processed-sequentially-per-email-skip-reasons-are-returned-for-items-that-fail-eg-duplicate-email-triggers-a-single-xray-restart-at-the-end-if-any-inbound-was-running
+      - content: Add many clients to a group in one call. Updates clients.group_name and
+          patches the matching client entry inside every owning inbound's
           settings JSON in a single transaction. If the group name does not yet
           exist (in client_groups or as a derived label), it is auto-created as
           a persistent group. To clear the group label, use /groups/bulkRemove
           instead.
-        id: >-
-          add-many-clients-to-a-group-in-one-call-updates-clientsgroup_name-and-patches-the-matching-client-entry-inside-every-owning-inbounds-settings-json-in-a-single-transaction-if-the-group-name-does-not-yet-exist-in-client_groups-or-as-a-derived-label-it-is-auto-created-as-a-persistent-group-to-clear-the-group-label-use-groupsbulkremove-instead
-      - content: >-
-          Clear the group label on many clients in one call. Inverse of
+        id: add-many-clients-to-a-group-in-one-call-updates-clientsgroup_name-and-patches-the-matching-client-entry-inside-every-owning-inbounds-settings-json-in-a-single-transaction-if-the-group-name-does-not-yet-exist-in-client_groups-or-as-a-derived-label-it-is-auto-created-as-a-persistent-group-to-clear-the-group-label-use-groupsbulkremove-instead
+      - content: Clear the group label on many clients in one call. Inverse of
           /groups/bulkAdd. Clients themselves are kept — only the group label is
           cleared from clients.group_name and from each owning inbound's
           settings JSON. Groups become empty if all their members are removed.
-        id: >-
-          clear-the-group-label-on-many-clients-in-one-call-inverse-of-groupsbulkadd-clients-themselves-are-kept--only-the-group-label-is-cleared-from-clientsgroup_name-and-from-each-owning-inbounds-settings-json-groups-become-empty-if-all-their-members-are-removed
-      - content: >-
-          Attach many existing clients to many inbounds in one call. Each client
+        id: clear-the-group-label-on-many-clients-in-one-call-inverse-of-groupsbulkadd-clients-themselves-are-kept--only-the-group-label-is-cleared-from-clientsgroup_name-and-from-each-owning-inbounds-settings-json-groups-become-empty-if-all-their-members-are-removed
+      - content: Attach many existing clients to many inbounds in one call. Each client
           keeps its identity (email/UUID/password/subId) and a shared traffic
           row; all clients are added to a target inbound in a single
           AddInboundClient call. Clients already present on a target are
           reported under skipped. Returns per-email attached/skipped/errors
           lists and triggers a single Xray restart if any target inbound was
           running.
-        id: >-
-          attach-many-existing-clients-to-many-inbounds-in-one-call-each-client-keeps-its-identity-emailuuidpasswordsubid-and-a-shared-traffic-row-all-clients-are-added-to-a-target-inbound-in-a-single-addinboundclient-call-clients-already-present-on-a-target-are-reported-under-skipped-returns-per-email-attachedskippederrors-lists-and-triggers-a-single-xray-restart-if-any-target-inbound-was-running
-      - content: >-
-          Mirror of bulkAttach: detach many existing clients from many inbounds
+        id: attach-many-existing-clients-to-many-inbounds-in-one-call-each-client-keeps-its-identity-emailuuidpasswordsubid-and-a-shared-traffic-row-all-clients-are-added-to-a-target-inbound-in-a-single-addinboundclient-call-clients-already-present-on-a-target-are-reported-under-skipped-returns-per-email-attachedskippederrors-lists-and-triggers-a-single-xray-restart-if-any-target-inbound-was-running
+      - content: "Mirror of bulkAttach: detach many existing clients from many inbounds
           in one call. For each email, intersects the client's current inbounds
           with the requested set and detaches from those only; (email, inbound)
           pairs where the client is not currently attached are silently no-ops.
@@ -498,117 +378,86 @@ _openapi:
           under skipped. Client records are kept even if they become orphaned —
           use bulkDel for full removal. Returns per-email
           detached/skipped/errors lists and triggers a single Xray restart if
-          any target inbound was running.
-        id: >-
-          mirror-of-bulkattach-detach-many-existing-clients-from-many-inbounds-in-one-call-for-each-email-intersects-the-clients-current-inbounds-with-the-requested-set-and-detaches-from-those-only-email-inbound-pairs-where-the-client-is-not-currently-attached-are-silently-no-ops-emails-not-attached-to-any-of-the-requested-inbounds-are-reported-under-skipped-client-records-are-kept-even-if-they-become-orphaned--use-bulkdel-for-full-removal-returns-per-email-detachedskippederrors-lists-and-triggers-a-single-xray-restart-if-any-target-inbound-was-running
-      - content: >-
-          Zero up/down counters for many clients in one call. Loops the
+          any target inbound was running."
+        id: mirror-of-bulkattach-detach-many-existing-clients-from-many-inbounds-in-one-call-for-each-email-intersects-the-clients-current-inbounds-with-the-requested-set-and-detaches-from-those-only-email-inbound-pairs-where-the-client-is-not-currently-attached-are-silently-no-ops-emails-not-attached-to-any-of-the-requested-inbounds-are-reported-under-skipped-client-records-are-kept-even-if-they-become-orphaned--use-bulkdel-for-full-removal-returns-per-email-detachedskippederrors-lists-and-triggers-a-single-xray-restart-if-any-target-inbound-was-running
+      - content: Zero up/down counters for many clients in one call. Loops the
           single-reset path so each client is re-enabled across its attached
           inbounds and pushed to Xray/remote nodes. Returns the count of
           successfully reset clients.
-        id: >-
-          zero-updown-counters-for-many-clients-in-one-call-loops-the-single-reset-path-so-each-client-is-re-enabled-across-its-attached-inbounds-and-pushed-to-xrayremote-nodes-returns-the-count-of-successfully-reset-clients
-      - content: >-
-          List all client groups with their member counts. Merges persisted
+        id: zero-updown-counters-for-many-clients-in-one-call-loops-the-single-reset-path-so-each-client-is-re-enabled-across-its-attached-inbounds-and-pushed-to-xrayremote-nodes-returns-the-count-of-successfully-reset-clients
+      - content: List all client groups with their member counts. Merges persisted
           groups (rows in client_groups, including empty placeholders) with the
           distinct group_name values currently set on clients. Sorted
           alphabetically (case-insensitive).
-        id: >-
-          list-all-client-groups-with-their-member-counts-merges-persisted-groups-rows-in-client_groups-including-empty-placeholders-with-the-distinct-group_name-values-currently-set-on-clients-sorted-alphabetically-case-insensitive
-      - content: >-
-          Return just the email list of clients that currently belong to the
+        id: list-all-client-groups-with-their-member-counts-merges-persisted-groups-rows-in-client_groups-including-empty-placeholders-with-the-distinct-group_name-values-currently-set-on-clients-sorted-alphabetically-case-insensitive
+      - content: Return just the email list of clients that currently belong to the
           given group. Useful for fanning a single bulk action over an entire
           group without round-tripping the full client list.
-        id: >-
-          return-just-the-email-list-of-clients-that-currently-belong-to-the-given-group-useful-for-fanning-a-single-bulk-action-over-an-entire-group-without-round-tripping-the-full-client-list
-      - content: >-
-          Create a new empty (placeholder) group. The group becomes selectable
-          in client forms and the filter drawer even before any client is added
-          to it. Errors if a group with the same name already exists.
-        id: >-
-          create-a-new-empty-placeholder-group-the-group-becomes-selectable-in-client-forms-and-the-filter-drawer-even-before-any-client-is-added-to-it-errors-if-a-group-with-the-same-name-already-exists
-      - content: >-
-          Rename a group. The new name is applied to the client_groups row AND
+        id: return-just-the-email-list-of-clients-that-currently-belong-to-the-given-group-useful-for-fanning-a-single-bulk-action-over-an-entire-group-without-round-tripping-the-full-client-list
+      - content: Create a new empty (placeholder) group. The group becomes selectable in
+          client forms and the filter drawer even before any client is added to
+          it. Errors if a group with the same name already exists.
+        id: create-a-new-empty-placeholder-group-the-group-becomes-selectable-in-client-forms-and-the-filter-drawer-even-before-any-client-is-added-to-it-errors-if-a-group-with-the-same-name-already-exists
+      - content: Rename a group. The new name is applied to the client_groups row AND
           propagated to every matching client (both clients.group_name and the
           client entry inside every owning inbound's settings JSON) in a single
           transaction. Returns the number of clients whose label was updated.
-        id: >-
-          rename-a-group-the-new-name-is-applied-to-the-client_groups-row-and-propagated-to-every-matching-client-both-clientsgroup_name-and-the-client-entry-inside-every-owning-inbounds-settings-json-in-a-single-transaction-returns-the-number-of-clients-whose-label-was-updated
-      - content: >-
-          Remove a group. Deletes the client_groups row and clears the group
+        id: rename-a-group-the-new-name-is-applied-to-the-client_groups-row-and-propagated-to-every-matching-client-both-clientsgroup_name-and-the-client-entry-inside-every-owning-inbounds-settings-json-in-a-single-transaction-returns-the-number-of-clients-whose-label-was-updated
+      - content: Remove a group. Deletes the client_groups row and clears the group
           label from every matching client (both clients.group_name and the
           inbound settings JSON). The clients themselves are NOT deleted — use
           /bulkDel after filtering by group for that. Returns the count of
           clients whose label was cleared.
-        id: >-
-          remove-a-group-deletes-the-client_groups-row-and-clears-the-group-label-from-every-matching-client-both-clientsgroup_name-and-the-inbound-settings-json-the-clients-themselves-are-not-deleted--use-bulkdel-after-filtering-by-group-for-that-returns-the-count-of-clients-whose-label-was-cleared
-      - content: >-
-          Zero out a single client’s up/down counters. Re-enables the client
+        id: remove-a-group-deletes-the-client_groups-row-and-clears-the-group-label-from-every-matching-client-both-clientsgroup_name-and-the-inbound-settings-json-the-clients-themselves-are-not-deleted--use-bulkdel-after-filtering-by-group-for-that-returns-the-count-of-clients-whose-label-was-cleared
+      - content: Zero out a single client’s up/down counters. Re-enables the client
           across every attached inbound and pushes the change to Xray (or the
           remote node) so depleted users can connect again immediately.
-        id: >-
-          zero-out-a-single-clients-updown-counters-re-enables-the-client-across-every-attached-inbound-and-pushes-the-change-to-xray-or-the-remote-node-so-depleted-users-can-connect-again-immediately
-      - content: >-
-          Manually adjust a client’s upload + download counters. Useful for
+        id: zero-out-a-single-clients-updown-counters-re-enables-the-client-across-every-attached-inbound-and-pushes-the-change-to-xray-or-the-remote-node-so-depleted-users-can-connect-again-immediately
+      - content: Manually adjust a client’s upload + download counters. Useful for
           migrations from external accounting systems.
-        id: >-
-          manually-adjust-a-clients-upload--download-counters-useful-for-migrations-from-external-accounting-systems
-      - content: >-
-          List source IPs that have connected with the given client’s
+        id: manually-adjust-a-clients-upload--download-counters-useful-for-migrations-from-external-accounting-systems
+      - content: List source IPs that have connected with the given client’s
           credentials. Returns an array of "ip (timestamp)" strings.
-        id: >-
-          list-source-ips-that-have-connected-with-the-given-clients-credentials-returns-an-array-of-ip-timestamp-strings
+        id: list-source-ips-that-have-connected-with-the-given-clients-credentials-returns-an-array-of-ip-timestamp-strings
       - content: Reset the recorded IP list for a client.
         id: reset-the-recorded-ip-list-for-a-client
-      - content: >-
-          List the emails of currently connected clients (last seen within the
+      - content: List the emails of currently connected clients (last seen within the
           heartbeat window), deduped across every node.
-        id: >-
-          list-the-emails-of-currently-connected-clients-last-seen-within-the-heartbeat-window-deduped-across-every-node
-      - content: >-
-          Online client emails grouped by the panelGuid of the node that
+        id: list-the-emails-of-currently-connected-clients-last-seen-within-the-heartbeat-window-deduped-across-every-node
+      - content: Online client emails grouped by the panelGuid of the node that
           physically hosts each client. The local panel uses its own GUID; each
           node (at any depth in a chain) uses its GUID. Lets the inbounds page
           attribute online status to the real node instead of the intermediate
           one it syncs through.
-        id: >-
-          online-client-emails-grouped-by-the-panelguid-of-the-node-that-physically-hosts-each-client-the-local-panel-uses-its-own-guid-each-node-at-any-depth-in-a-chain-uses-its-guid-lets-the-inbounds-page-attribute-online-status-to-the-real-node-instead-of-the-intermediate-one-it-syncs-through
-      - content: >-
-          Per-client source IPs grouped by the panelGuid of the node that
+        id: online-client-emails-grouped-by-the-panelguid-of-the-node-that-physically-hosts-each-client-the-local-panel-uses-its-own-guid-each-node-at-any-depth-in-a-chain-uses-its-guid-lets-the-inbounds-page-attribute-online-status-to-the-real-node-instead-of-the-intermediate-one-it-syncs-through
+      - content: Per-client source IPs grouped by the panelGuid of the node that
           observed them. Lets the central panel attribute and enforce per-client
           IP limits using the real visitor IPs each node sees, instead of the
           address of the intermediate panel it syncs through.
-        id: >-
-          per-client-source-ips-grouped-by-the-panelguid-of-the-node-that-observed-them-lets-the-central-panel-attribute-and-enforce-per-client-ip-limits-using-the-real-visitor-ips-each-node-sees-instead-of-the-address-of-the-intermediate-panel-it-syncs-through
-      - content: >-
-          Inbound tags that carried traffic within the heartbeat window, grouped
+        id: per-client-source-ips-grouped-by-the-panelguid-of-the-node-that-observed-them-lets-the-central-panel-attribute-and-enforce-per-client-ip-limits-using-the-real-visitor-ips-each-node-sees-instead-of-the-address-of-the-intermediate-panel-it-syncs-through
+      - content: Inbound tags that carried traffic within the heartbeat window, grouped
           by the hosting node's panelGuid. Pairs with onlinesByGuid so the
           inbounds page only marks a multi-inbound client online on the inbounds
           it actually used. Nodes that do not report per-inbound activity are
           absent.
-        id: >-
-          inbound-tags-that-carried-traffic-within-the-heartbeat-window-grouped-by-the-hosting-nodes-panelguid-pairs-with-onlinesbyguid-so-the-inbounds-page-only-marks-a-multi-inbound-client-online-on-the-inbounds-it-actually-used-nodes-that-do-not-report-per-inbound-activity-are-absent
+        id: inbound-tags-that-carried-traffic-within-the-heartbeat-window-grouped-by-the-hosting-nodes-panelguid-pairs-with-onlinesbyguid-so-the-inbounds-page-only-marks-a-multi-inbound-client-online-on-the-inbounds-it-actually-used-nodes-that-do-not-report-per-inbound-activity-are-absent
       - content: Map of client email → last-seen unix timestamp.
         id: map-of-client-email--last-seen-unix-timestamp
       - content: Traffic counters for a client identified by email.
         id: traffic-counters-for-a-client-identified-by-email
-      - content: >-
-          Return every protocol URL (vless://, vmess://, trojan://, ss://,
+      - content: Return every protocol URL (vless://, vmess://, trojan://, ss://,
           hysteria://, hy2://) for clients matching the subscription ID. Same
           result set as /sub/<subId>, but as a JSON array — no base64. When an
           inbound has streamSettings.externalProxy set, one URL is emitted per
           external proxy. Empty array when the subId has no enabled clients.
-        id: >-
-          return-every-protocol-url-vless-vmess-trojan-ss-hysteria-hy2-for-clients-matching-the-subscription-id-same-result-set-as-subsubid-but-as-a-json-array--no-base64-when-an-inbound-has-streamsettingsexternalproxy-set-one-url-is-emitted-per-external-proxy-empty-array-when-the-subid-has-no-enabled-clients
-      - content: >-
-          Return every URL for one client across all attached inbounds — the
+        id: return-every-protocol-url-vless-vmess-trojan-ss-hysteria-hy2-for-clients-matching-the-subscription-id-same-result-set-as-subsubid-but-as-a-json-array--no-base64-when-an-inbound-has-streamsettingsexternalproxy-set-one-url-is-emitted-per-external-proxy-empty-array-when-the-subid-has-no-enabled-clients
+      - content: 'Return every URL for one client across all attached inbounds — the
           same strings the Copy URL button copies in the panel UI. Supported
           protocols: vmess, vless, trojan, shadowsocks, hysteria. If
           streamSettings.externalProxy is set, returns one URL per external
           proxy. Protocols without a URL form (socks, http, mixed, wireguard,
-          dokodemo, tunnel) contribute nothing.
-        id: >-
-          return-every-url-for-one-client-across-all-attached-inbounds--the-same-strings-the-copy-url-button-copies-in-the-panel-ui-supported-protocols-vmess-vless-trojan-shadowsocks-hysteria-if-streamsettingsexternalproxy-is-set-returns-one-url-per-external-proxy-protocols-without-a-url-form-socks-http-mixed-wireguard-dokodemo-tunnel-contribute-nothing
+          dokodemo, tunnel) contribute nothing.'
+        id: return-every-url-for-one-client-across-all-attached-inbounds--the-same-strings-the-copy-url-button-copies-in-the-panel-ui-supported-protocols-vmess-vless-trojan-shadowsocks-hysteria-if-streamsettingsexternalproxy-is-set-returns-one-url-per-external-proxy-protocols-without-a-url-form-socks-http-mixed-wireguard-dokodemo-tunnel-contribute-nothing
     contents: []
 ---
 

+ 19 - 36
docs/content/docs/en/reference/api/hosts.mdx

@@ -1,7 +1,6 @@
 ---
 title: Hosts
-description: >-
-  Per-inbound override endpoints. Each enabled host renders one extra
+description: Per-inbound override endpoints. Each enabled host renders one extra
   subscription link/proxy with its own address/port/TLS, superseding the legacy
   externalProxy array. All endpoints under /panel/api/hosts.
 full: true
@@ -10,11 +9,9 @@ _openapi:
     - ./public/openapi.json
   toc:
     - depth: 2
-      title: >-
-        List every host across all inbounds, grouped by inbound then ordered by
+      title: List every host across all inbounds, grouped by inbound then ordered by
         sort order.
-      url: >-
-        #list-every-host-across-all-inbounds-grouped-by-inbound-then-ordered-by-sort-order
+      url: '#list-every-host-across-all-inbounds-grouped-by-inbound-then-ordered-by-sort-order'
     - depth: 2
       title: Fetch a single host by ID.
       url: '#fetch-a-single-host-by-id'
@@ -25,26 +22,20 @@ _openapi:
       title: Distinct, sorted set of tags used across all hosts.
       url: '#distinct-sorted-set-of-tags-used-across-all-hosts'
     - depth: 2
-      title: >-
-        Create a host on an inbound. inboundId and remark are required; security
+      title: Create a host on an inbound. inboundId and remark are required; security
         defaults to "same" (inherit the inbound).
-      url: >-
-        #create-a-host-on-an-inbound-inboundid-and-remark-are-required-security-defaults-to-same-inherit-the-inbound
+      url: '#create-a-host-on-an-inbound-inboundid-and-remark-are-required-security-defaults-to-same-inherit-the-inbound'
     - depth: 2
-      title: >-
-        Replace a host’s content. The inbound and sort order are immutable here
+      title: Replace a host’s content. The inbound and sort order are immutable here
         (use /reorder for ordering).
-      url: >-
-        #replace-a-hosts-content-the-inbound-and-sort-order-are-immutable-here-use-reorder-for-ordering
+      url: '#replace-a-hosts-content-the-inbound-and-sort-order-are-immutable-here-use-reorder-for-ordering'
     - depth: 2
       title: Delete a host.
       url: '#delete-a-host'
     - depth: 2
-      title: >-
-        Enable or disable a single host (disabled hosts are skipped in
+      title: Enable or disable a single host (disabled hosts are skipped in
         subscriptions).
-      url: >-
-        #enable-or-disable-a-single-host-disabled-hosts-are-skipped-in-subscriptions
+      url: '#enable-or-disable-a-single-host-disabled-hosts-are-skipped-in-subscriptions'
     - depth: 2
       title: Set host sort order by the position of each id in the array.
       url: '#set-host-sort-order-by-the-position-of-each-id-in-the-array'
@@ -56,34 +47,26 @@ _openapi:
       url: '#delete-many-hosts-in-one-call'
   structuredData:
     headings:
-      - content: >-
-          List every host across all inbounds, grouped by inbound then ordered
-          by sort order.
-        id: >-
-          list-every-host-across-all-inbounds-grouped-by-inbound-then-ordered-by-sort-order
+      - content: List every host across all inbounds, grouped by inbound then ordered by
+          sort order.
+        id: list-every-host-across-all-inbounds-grouped-by-inbound-then-ordered-by-sort-order
       - content: Fetch a single host by ID.
         id: fetch-a-single-host-by-id
       - content: Fetch one inbound's hosts, ordered by sort order then id.
         id: fetch-one-inbounds-hosts-ordered-by-sort-order-then-id
       - content: Distinct, sorted set of tags used across all hosts.
         id: distinct-sorted-set-of-tags-used-across-all-hosts
-      - content: >-
-          Create a host on an inbound. inboundId and remark are required;
+      - content: Create a host on an inbound. inboundId and remark are required;
           security defaults to "same" (inherit the inbound).
-        id: >-
-          create-a-host-on-an-inbound-inboundid-and-remark-are-required-security-defaults-to-same-inherit-the-inbound
-      - content: >-
-          Replace a host’s content. The inbound and sort order are immutable
-          here (use /reorder for ordering).
-        id: >-
-          replace-a-hosts-content-the-inbound-and-sort-order-are-immutable-here-use-reorder-for-ordering
+        id: create-a-host-on-an-inbound-inboundid-and-remark-are-required-security-defaults-to-same-inherit-the-inbound
+      - content: Replace a host’s content. The inbound and sort order are immutable here
+          (use /reorder for ordering).
+        id: replace-a-hosts-content-the-inbound-and-sort-order-are-immutable-here-use-reorder-for-ordering
       - content: Delete a host.
         id: delete-a-host
-      - content: >-
-          Enable or disable a single host (disabled hosts are skipped in
+      - content: Enable or disable a single host (disabled hosts are skipped in
           subscriptions).
-        id: >-
-          enable-or-disable-a-single-host-disabled-hosts-are-skipped-in-subscriptions
+        id: enable-or-disable-a-single-host-disabled-hosts-are-skipped-in-subscriptions
       - content: Set host sort order by the position of each id in the array.
         id: set-host-sort-order-by-the-position-of-each-id-in-the-array
       - content: Enable or disable many hosts in one call.

+ 124 - 232
docs/content/docs/en/reference/api/server.mdx

@@ -1,65 +1,48 @@
 ---
 title: Server
-description: >-
-  System status, log retrieval, certificate generators, Xray binary management,
-  and backup/restore. All under /panel/api/server.
+description: System status, log retrieval, certificate generators, Xray binary
+  management, and backup/restore. All under /panel/api/server.
 full: true
 _openapi:
   preload:
     - ./public/openapi.json
   toc:
     - depth: 2
-      title: >-
-        Real-time machine snapshot: CPU, memory, swap, disk, network IO, load
+      title: 'Real-time machine snapshot: CPU, memory, swap, disk, network IO, load
         averages, open connections, Xray state. Cached and refreshed every 2
-        seconds in the background.
-      url: >-
-        #real-time-machine-snapshot-cpu-memory-swap-disk-network-io-load-averages-open-connections-xray-state-cached-and-refreshed-every-2-seconds-in-the-background
+        seconds in the background.'
+      url: '#real-time-machine-snapshot-cpu-memory-swap-disk-network-io-load-averages-open-connections-xray-state-cached-and-refreshed-every-2-seconds-in-the-background'
     - depth: 2
-      title: >-
-        Reports whether per-client IP limits can be enforced on this host. The
+      title: Reports whether per-client IP limits can be enforced on this host. The
         panel uses it to gate the "IP Limit" field, since enforcement depends on
         Fail2ban being installed.
-      url: >-
-        #reports-whether-per-client-ip-limits-can-be-enforced-on-this-host-the-panel-uses-it-to-gate-the-ip-limit-field-since-enforcement-depends-on-fail2ban-being-installed
-    - depth: 2
-      title: >-
-        Legacy: aggregated CPU history. Use /history/cpu/:bucket instead — same
-        data with a uniform {t, v} shape.
-      url: >-
-        #legacy-aggregated-cpu-history-use-historycpubucket-instead--same-data-with-a-uniform-t-v-shape
-    - depth: 2
-      title: >-
-        Aggregated time-series for one metric. Returns an array of {t, v}
-        samples covering the last ~6 hours.
-      url: >-
-        #aggregated-time-series-for-one-metric-returns-an-array-of-t-v-samples-covering-the-last-6-hours
-    - depth: 2
-      title: >-
-        Xray runtime metrics state — whether the xray config has a `metrics`
+      url: '#reports-whether-per-client-ip-limits-can-be-enforced-on-this-host-the-panel-uses-it-to-gate-the-ip-limit-field-since-enforcement-depends-on-fail2ban-being-installed'
+    - depth: 2
+      title: 'Legacy: aggregated CPU history. Use /history/cpu/:bucket instead — same
+        data with a uniform {t, v} shape.'
+      url: '#legacy-aggregated-cpu-history-use-historycpubucket-instead--same-data-with-a-uniform-t-v-shape'
+    - depth: 2
+      title: Aggregated time-series for one metric. Returns an array of {t, v} samples
+        covering the last ~6 hours.
+      url: '#aggregated-time-series-for-one-metric-returns-an-array-of-t-v-samples-covering-the-last-6-hours'
+    - depth: 2
+      title: Xray runtime metrics state — whether the xray config has a `metrics`
         block, which expvar keys are flowing, and the current snapshot values
         for each. Returns an empty state when metrics are not configured.
-      url: >-
-        #xray-runtime-metrics-state--whether-the-xray-config-has-a-metrics-block-which-expvar-keys-are-flowing-and-the-current-snapshot-values-for-each-returns-an-empty-state-when-metrics-are-not-configured
+      url: '#xray-runtime-metrics-state--whether-the-xray-config-has-a-metrics-block-which-expvar-keys-are-flowing-and-the-current-snapshot-values-for-each-returns-an-empty-state-when-metrics-are-not-configured'
     - depth: 2
-      title: >-
-        Time-series history for one Xray runtime metric over the last ~6 hours.
+      title: Time-series history for one Xray runtime metric over the last ~6 hours.
         Same {t, v} shape as /history/:metric/:bucket.
-      url: >-
-        #time-series-history-for-one-xray-runtime-metric-over-the-last-6-hours-same-t-v-shape-as-historymetricbucket
+      url: '#time-series-history-for-one-xray-runtime-metric-over-the-last-6-hours-same-t-v-shape-as-historymetricbucket'
     - depth: 2
-      title: >-
-        Latest snapshot from the Xray observatory — per-outbound latency, health
+      title: Latest snapshot from the Xray observatory — per-outbound latency, health
         status, and last-probe time. Only populated when the Xray config has an
         observatory configured.
-      url: >-
-        #latest-snapshot-from-the-xray-observatory--per-outbound-latency-health-status-and-last-probe-time-only-populated-when-the-xray-config-has-an-observatory-configured
+      url: '#latest-snapshot-from-the-xray-observatory--per-outbound-latency-health-status-and-last-probe-time-only-populated-when-the-xray-config-has-an-observatory-configured'
     - depth: 2
-      title: >-
-        Time-series of observatory probe results for one outbound tag. Same {t,
+      title: Time-series of observatory probe results for one outbound tag. Same {t,
         v} shape as the other history endpoints.
-      url: >-
-        #time-series-of-observatory-probe-results-for-one-outbound-tag-same-t-v-shape-as-the-other-history-endpoints
+      url: '#time-series-of-observatory-probe-results-for-one-outbound-tag-same-t-v-shape-as-the-other-history-endpoints'
     - depth: 2
       title: List Xray binary versions available for install on this host.
       url: '#list-xray-binary-versions-available-for-install-on-this-host'
@@ -70,90 +53,66 @@ _openapi:
       title: Return the assembled Xray config that’s currently running on this host.
       url: '#return-the-assembled-xray-config-thats-currently-running-on-this-host'
     - depth: 2
-      title: >-
-        Stream the SQLite database file as an attachment. Use as a manual
-        backup.
+      title: Stream the SQLite database file as an attachment. Use as a manual backup.
       url: '#stream-the-sqlite-database-file-as-an-attachment-use-as-a-manual-backup'
     - depth: 2
-      title: >-
-        Stream a cross-engine migration file as an attachment: a .dump (SQL
+      title: 'Stream a cross-engine migration file as an attachment: a .dump (SQL
         text) on SQLite, or a .db SQLite database built from the live data on
-        PostgreSQL.
-      url: >-
-        #stream-a-cross-engine-migration-file-as-an-attachment-a-dump-sql-text-on-sqlite-or-a-db-sqlite-database-built-from-the-live-data-on-postgresql
+        PostgreSQL.'
+      url: '#stream-a-cross-engine-migration-file-as-an-attachment-a-dump-sql-text-on-sqlite-or-a-db-sqlite-database-built-from-the-live-data-on-postgresql'
     - depth: 2
       title: Generate a fresh UUID v4. Convenience helper for client IDs.
       url: '#generate-a-fresh-uuid-v4-convenience-helper-for-client-ids'
     - depth: 2
-      title: >-
-        Return this panel's own web TLS certificate and key file paths. The
+      title: Return this panel's own web TLS certificate and key file paths. The
         central panel calls it on a node (via the node API token) so "Set Cert
         from Panel" fills a node-assigned inbound with paths that exist on the
         node.
-      url: >-
-        #return-this-panels-own-web-tls-certificate-and-key-file-paths-the-central-panel-calls-it-on-a-node-via-the-node-api-token-so-set-cert-from-panel-fills-a-node-assigned-inbound-with-paths-that-exist-on-the-node
+      url: '#return-this-panels-own-web-tls-certificate-and-key-file-paths-the-central-panel-calls-it-on-a-node-via-the-node-api-token-so-set-cert-from-panel-fills-a-node-assigned-inbound-with-paths-that-exist-on-the-node'
     - depth: 2
-      title: >-
-        Read-only summaries (guid, parentGuid, name, address, status, versions)
+      title: Read-only summaries (guid, parentGuid, name, address, status, versions)
         of the nodes this panel manages. A parent panel calls it on a node (via
         the node API token) to surface transitive sub-nodes in a chained
         topology. Counts are computed by the parent, not returned here.
-      url: >-
-        #read-only-summaries-guid-parentguid-name-address-status-versions-of-the-nodes-this-panel-manages-a-parent-panel-calls-it-on-a-node-via-the-node-api-token-to-surface-transitive-sub-nodes-in-a-chained-topology-counts-are-computed-by-the-parent-not-returned-here
+      url: '#read-only-summaries-guid-parentguid-name-address-status-versions-of-the-nodes-this-panel-manages-a-parent-panel-calls-it-on-a-node-via-the-node-api-token-to-surface-transitive-sub-nodes-in-a-chained-topology-counts-are-computed-by-the-parent-not-returned-here'
     - depth: 2
       title: Generate a new X25519 keypair for Reality.
       url: '#generate-a-new-x25519-keypair-for-reality'
     - depth: 2
-      title: >-
-        Generate a new ML-DSA-65 keypair (post-quantum signature). Returns
+      title: Generate a new ML-DSA-65 keypair (post-quantum signature). Returns
         {privateKey, publicKey, seed}.
-      url: >-
-        #generate-a-new-ml-dsa-65-keypair-post-quantum-signature-returns-privatekey-publickey-seed
+      url: '#generate-a-new-ml-dsa-65-keypair-post-quantum-signature-returns-privatekey-publickey-seed'
     - depth: 2
-      title: >-
-        Generate a new ML-KEM-768 keypair (post-quantum KEM). Returns
-        {clientKey, serverKey}.
-      url: >-
-        #generate-a-new-ml-kem-768-keypair-post-quantum-kem-returns-clientkey-serverkey
+      title: Generate a new ML-KEM-768 keypair (post-quantum KEM). Returns {clientKey,
+        serverKey}.
+      url: '#generate-a-new-ml-kem-768-keypair-post-quantum-kem-returns-clientkey-serverkey'
     - depth: 2
-      title: >-
-        Generate VLESS encryption auth options. Returns an auths array each with
+      title: Generate VLESS encryption auth options. Returns an auths array each with
         id, label, encryption, and decryption fields.
-      url: >-
-        #generate-vless-encryption-auth-options-returns-an-auths-array-each-with-id-label-encryption-and-decryption-fields
+      url: '#generate-vless-encryption-auth-options-returns-an-auths-array-each-with-id-label-encryption-and-decryption-fields'
     - depth: 2
       title: Stop the Xray binary. All proxies go offline immediately.
       url: '#stop-the-xray-binary-all-proxies-go-offline-immediately'
     - depth: 2
-      title: >-
-        Reload Xray with the current config. Typically required after structural
+      title: Reload Xray with the current config. Typically required after structural
         inbound or routing changes.
-      url: >-
-        #reload-xray-with-the-current-config-typically-required-after-structural-inbound-or-routing-changes
+      url: '#reload-xray-with-the-current-config-typically-required-after-structural-inbound-or-routing-changes'
     - depth: 2
-      title: >-
-        Download and install the specified Xray version. Pass "latest" for the
+      title: Download and install the specified Xray version. Pass "latest" for the
         newest release.
-      url: >-
-        #download-and-install-the-specified-xray-version-pass-latest-for-the-newest-release
+      url: '#download-and-install-the-specified-xray-version-pass-latest-for-the-newest-release'
     - depth: 2
-      title: >-
-        Self-update the panel to the latest version. The server restarts on
+      title: Self-update the panel to the latest version. The server restarts on
         success.
-      url: >-
-        #self-update-the-panel-to-the-latest-version-the-server-restarts-on-success
+      url: '#self-update-the-panel-to-the-latest-version-the-server-restarts-on-success'
     - depth: 2
-      title: >-
-        Toggle the panel update channel between stable and the rolling
-        per-commit dev release. Only effective on dev builds.
-      url: >-
-        #toggle-the-panel-update-channel-between-stable-and-the-rolling-per-commit-dev-release-only-effective-on-dev-builds
+      title: Toggle the panel update channel between stable and the rolling per-commit
+        dev release. Only effective on dev builds.
+      url: '#toggle-the-panel-update-channel-between-stable-and-the-rolling-per-commit-dev-release-only-effective-on-dev-builds'
     - depth: 2
-      title: >-
-        Refresh the default GeoIP / GeoSite data files. Body can include a
+      title: Refresh the default GeoIP / GeoSite data files. Body can include a
         fileName, or use the /:fileName variant.
-      url: >-
-        #refresh-the-default-geoip--geosite-data-files-body-can-include-a-filename-or-use-the-filename-variant
+      url: '#refresh-the-default-geoip--geosite-data-files-body-can-include-a-filename-or-use-the-filename-variant'
     - depth: 2
       title: Refresh a single Geo file by filename (e.g. geoip.dat, geosite.dat).
       url: '#refresh-a-single-geo-file-by-filename-eg-geoipdat-geositedat'
@@ -164,205 +123,138 @@ _openapi:
       title: Return the last N lines of the Xray process log.
       url: '#return-the-last-n-lines-of-the-xray-process-log'
     - depth: 2
-      title: >-
-        Restore the panel DB from an uploaded SQLite file (multipart form, field
+      title: Restore the panel DB from an uploaded SQLite file (multipart form, field
         name "db"). The panel restarts after restore. Destructive.
-      url: >-
-        #restore-the-panel-db-from-an-uploaded-sqlite-file-multipart-form-field-name-db-the-panel-restarts-after-restore-destructive
+      url: '#restore-the-panel-db-from-an-uploaded-sqlite-file-multipart-form-field-name-db-the-panel-restarts-after-restore-destructive'
     - depth: 2
-      title: >-
-        Generate a new ECH (Encrypted Client Hello) keypair and config list for
+      title: Generate a new ECH (Encrypted Client Hello) keypair and config list for
         the given SNI.
-      url: >-
-        #generate-a-new-ech-encrypted-client-hello-keypair-and-config-list-for-the-given-sni
+      url: '#generate-a-new-ech-encrypted-client-hello-keypair-and-config-list-for-the-given-sni'
     - depth: 2
-      title: >-
-        Compute the hex SHA-256 of a certificate (DER) for pinning
+      title: Compute the hex SHA-256 of a certificate (DER) for pinning
         (pinnedPeerCertSha256). Provide either a server file path or inline
         PEM/DER content.
-      url: >-
-        #compute-the-hex-sha-256-of-a-certificate-der-for-pinning-pinnedpeercertsha256-provide-either-a-server-file-path-or-inline-pemder-content
+      url: '#compute-the-hex-sha-256-of-a-certificate-der-for-pinning-pinnedpeercertsha256-provide-either-a-server-file-path-or-inline-pemder-content'
     - depth: 2
-      title: >-
-        Run `xray tls ping` against a remote server and return its live
+      title: Run `xray tls ping` against a remote server and return its live
         leaf-certificate SHA-256 hash(es) for pinning (pinnedPeerCertSha256).
-      url: >-
-        #run-xray-tls-ping-against-a-remote-server-and-return-its-live-leaf-certificate-sha-256-hashes-for-pinning-pinnedpeercertsha256
+      url: '#run-xray-tls-ping-against-a-remote-server-and-return-its-live-leaf-certificate-sha-256-hashes-for-pinning-pinnedpeercertsha256'
     - depth: 2
-      title: >-
-        Fetch the fully aggregated inbound_client_ips database table. Used by
+      title: Fetch the fully aggregated inbound_client_ips database table. Used by
         nodes to sync recently active IPs across the cluster.
-      url: >-
-        #fetch-the-fully-aggregated-inbound_client_ips-database-table-used-by-nodes-to-sync-recently-active-ips-across-the-cluster
+      url: '#fetch-the-fully-aggregated-inbound_client_ips-database-table-used-by-nodes-to-sync-recently-active-ips-across-the-cluster'
     - depth: 2
-      title: >-
-        Submit a list of recently active IP timestamps. The panel merges them
+      title: Submit a list of recently active IP timestamps. The panel merges them
         with the existing database to maintain a unified global IP-limit view.
-      url: >-
-        #submit-a-list-of-recently-active-ip-timestamps-the-panel-merges-them-with-the-existing-database-to-maintain-a-unified-global-ip-limit-view
+      url: '#submit-a-list-of-recently-active-ip-timestamps-the-panel-merges-them-with-the-existing-database-to-maintain-a-unified-global-ip-limit-view'
   structuredData:
     headings:
-      - content: >-
-          Real-time machine snapshot: CPU, memory, swap, disk, network IO, load
+      - content: 'Real-time machine snapshot: CPU, memory, swap, disk, network IO, load
           averages, open connections, Xray state. Cached and refreshed every 2
-          seconds in the background.
-        id: >-
-          real-time-machine-snapshot-cpu-memory-swap-disk-network-io-load-averages-open-connections-xray-state-cached-and-refreshed-every-2-seconds-in-the-background
-      - content: >-
-          Reports whether per-client IP limits can be enforced on this host. The
+          seconds in the background.'
+        id: real-time-machine-snapshot-cpu-memory-swap-disk-network-io-load-averages-open-connections-xray-state-cached-and-refreshed-every-2-seconds-in-the-background
+      - content: Reports whether per-client IP limits can be enforced on this host. The
           panel uses it to gate the "IP Limit" field, since enforcement depends
           on Fail2ban being installed.
-        id: >-
-          reports-whether-per-client-ip-limits-can-be-enforced-on-this-host-the-panel-uses-it-to-gate-the-ip-limit-field-since-enforcement-depends-on-fail2ban-being-installed
-      - content: >-
-          Legacy: aggregated CPU history. Use /history/cpu/:bucket instead —
-          same data with a uniform {t, v} shape.
-        id: >-
-          legacy-aggregated-cpu-history-use-historycpubucket-instead--same-data-with-a-uniform-t-v-shape
-      - content: >-
-          Aggregated time-series for one metric. Returns an array of {t, v}
+        id: reports-whether-per-client-ip-limits-can-be-enforced-on-this-host-the-panel-uses-it-to-gate-the-ip-limit-field-since-enforcement-depends-on-fail2ban-being-installed
+      - content: 'Legacy: aggregated CPU history. Use /history/cpu/:bucket instead —
+          same data with a uniform {t, v} shape.'
+        id: legacy-aggregated-cpu-history-use-historycpubucket-instead--same-data-with-a-uniform-t-v-shape
+      - content: Aggregated time-series for one metric. Returns an array of {t, v}
           samples covering the last ~6 hours.
-        id: >-
-          aggregated-time-series-for-one-metric-returns-an-array-of-t-v-samples-covering-the-last-6-hours
-      - content: >-
-          Xray runtime metrics state — whether the xray config has a `metrics`
+        id: aggregated-time-series-for-one-metric-returns-an-array-of-t-v-samples-covering-the-last-6-hours
+      - content: Xray runtime metrics state — whether the xray config has a `metrics`
           block, which expvar keys are flowing, and the current snapshot values
           for each. Returns an empty state when metrics are not configured.
-        id: >-
-          xray-runtime-metrics-state--whether-the-xray-config-has-a-metrics-block-which-expvar-keys-are-flowing-and-the-current-snapshot-values-for-each-returns-an-empty-state-when-metrics-are-not-configured
-      - content: >-
-          Time-series history for one Xray runtime metric over the last ~6
-          hours. Same {t, v} shape as /history/:metric/:bucket.
-        id: >-
-          time-series-history-for-one-xray-runtime-metric-over-the-last-6-hours-same-t-v-shape-as-historymetricbucket
-      - content: >-
-          Latest snapshot from the Xray observatory — per-outbound latency,
+        id: xray-runtime-metrics-state--whether-the-xray-config-has-a-metrics-block-which-expvar-keys-are-flowing-and-the-current-snapshot-values-for-each-returns-an-empty-state-when-metrics-are-not-configured
+      - content: Time-series history for one Xray runtime metric over the last ~6 hours.
+          Same {t, v} shape as /history/:metric/:bucket.
+        id: time-series-history-for-one-xray-runtime-metric-over-the-last-6-hours-same-t-v-shape-as-historymetricbucket
+      - content: Latest snapshot from the Xray observatory — per-outbound latency,
           health status, and last-probe time. Only populated when the Xray
           config has an observatory configured.
-        id: >-
-          latest-snapshot-from-the-xray-observatory--per-outbound-latency-health-status-and-last-probe-time-only-populated-when-the-xray-config-has-an-observatory-configured
-      - content: >-
-          Time-series of observatory probe results for one outbound tag. Same
-          {t, v} shape as the other history endpoints.
-        id: >-
-          time-series-of-observatory-probe-results-for-one-outbound-tag-same-t-v-shape-as-the-other-history-endpoints
+        id: latest-snapshot-from-the-xray-observatory--per-outbound-latency-health-status-and-last-probe-time-only-populated-when-the-xray-config-has-an-observatory-configured
+      - content: Time-series of observatory probe results for one outbound tag. Same {t,
+          v} shape as the other history endpoints.
+        id: time-series-of-observatory-probe-results-for-one-outbound-tag-same-t-v-shape-as-the-other-history-endpoints
       - content: List Xray binary versions available for install on this host.
         id: list-xray-binary-versions-available-for-install-on-this-host
       - content: Check whether a newer 3x-ui release is available on GitHub.
         id: check-whether-a-newer-3x-ui-release-is-available-on-github
-      - content: >-
-          Return the assembled Xray config that’s currently running on this
-          host.
+      - content: Return the assembled Xray config that’s currently running on this host.
         id: return-the-assembled-xray-config-thats-currently-running-on-this-host
-      - content: >-
-          Stream the SQLite database file as an attachment. Use as a manual
+      - content: Stream the SQLite database file as an attachment. Use as a manual
           backup.
-        id: >-
-          stream-the-sqlite-database-file-as-an-attachment-use-as-a-manual-backup
-      - content: >-
-          Stream a cross-engine migration file as an attachment: a .dump (SQL
+        id: stream-the-sqlite-database-file-as-an-attachment-use-as-a-manual-backup
+      - content: 'Stream a cross-engine migration file as an attachment: a .dump (SQL
           text) on SQLite, or a .db SQLite database built from the live data on
-          PostgreSQL.
-        id: >-
-          stream-a-cross-engine-migration-file-as-an-attachment-a-dump-sql-text-on-sqlite-or-a-db-sqlite-database-built-from-the-live-data-on-postgresql
+          PostgreSQL.'
+        id: stream-a-cross-engine-migration-file-as-an-attachment-a-dump-sql-text-on-sqlite-or-a-db-sqlite-database-built-from-the-live-data-on-postgresql
       - content: Generate a fresh UUID v4. Convenience helper for client IDs.
         id: generate-a-fresh-uuid-v4-convenience-helper-for-client-ids
-      - content: >-
-          Return this panel's own web TLS certificate and key file paths. The
+      - content: Return this panel's own web TLS certificate and key file paths. The
           central panel calls it on a node (via the node API token) so "Set Cert
           from Panel" fills a node-assigned inbound with paths that exist on the
           node.
-        id: >-
-          return-this-panels-own-web-tls-certificate-and-key-file-paths-the-central-panel-calls-it-on-a-node-via-the-node-api-token-so-set-cert-from-panel-fills-a-node-assigned-inbound-with-paths-that-exist-on-the-node
-      - content: >-
-          Read-only summaries (guid, parentGuid, name, address, status,
-          versions) of the nodes this panel manages. A parent panel calls it on
-          a node (via the node API token) to surface transitive sub-nodes in a
-          chained topology. Counts are computed by the parent, not returned
-          here.
-        id: >-
-          read-only-summaries-guid-parentguid-name-address-status-versions-of-the-nodes-this-panel-manages-a-parent-panel-calls-it-on-a-node-via-the-node-api-token-to-surface-transitive-sub-nodes-in-a-chained-topology-counts-are-computed-by-the-parent-not-returned-here
+        id: return-this-panels-own-web-tls-certificate-and-key-file-paths-the-central-panel-calls-it-on-a-node-via-the-node-api-token-so-set-cert-from-panel-fills-a-node-assigned-inbound-with-paths-that-exist-on-the-node
+      - content: Read-only summaries (guid, parentGuid, name, address, status, versions)
+          of the nodes this panel manages. A parent panel calls it on a node
+          (via the node API token) to surface transitive sub-nodes in a chained
+          topology. Counts are computed by the parent, not returned here.
+        id: read-only-summaries-guid-parentguid-name-address-status-versions-of-the-nodes-this-panel-manages-a-parent-panel-calls-it-on-a-node-via-the-node-api-token-to-surface-transitive-sub-nodes-in-a-chained-topology-counts-are-computed-by-the-parent-not-returned-here
       - content: Generate a new X25519 keypair for Reality.
         id: generate-a-new-x25519-keypair-for-reality
-      - content: >-
-          Generate a new ML-DSA-65 keypair (post-quantum signature). Returns
+      - content: Generate a new ML-DSA-65 keypair (post-quantum signature). Returns
           {privateKey, publicKey, seed}.
-        id: >-
-          generate-a-new-ml-dsa-65-keypair-post-quantum-signature-returns-privatekey-publickey-seed
-      - content: >-
-          Generate a new ML-KEM-768 keypair (post-quantum KEM). Returns
+        id: generate-a-new-ml-dsa-65-keypair-post-quantum-signature-returns-privatekey-publickey-seed
+      - content: Generate a new ML-KEM-768 keypair (post-quantum KEM). Returns
           {clientKey, serverKey}.
-        id: >-
-          generate-a-new-ml-kem-768-keypair-post-quantum-kem-returns-clientkey-serverkey
-      - content: >-
-          Generate VLESS encryption auth options. Returns an auths array each
+        id: generate-a-new-ml-kem-768-keypair-post-quantum-kem-returns-clientkey-serverkey
+      - content: Generate VLESS encryption auth options. Returns an auths array each
           with id, label, encryption, and decryption fields.
-        id: >-
-          generate-vless-encryption-auth-options-returns-an-auths-array-each-with-id-label-encryption-and-decryption-fields
+        id: generate-vless-encryption-auth-options-returns-an-auths-array-each-with-id-label-encryption-and-decryption-fields
       - content: Stop the Xray binary. All proxies go offline immediately.
         id: stop-the-xray-binary-all-proxies-go-offline-immediately
-      - content: >-
-          Reload Xray with the current config. Typically required after
+      - content: Reload Xray with the current config. Typically required after
           structural inbound or routing changes.
-        id: >-
-          reload-xray-with-the-current-config-typically-required-after-structural-inbound-or-routing-changes
-      - content: >-
-          Download and install the specified Xray version. Pass "latest" for the
+        id: reload-xray-with-the-current-config-typically-required-after-structural-inbound-or-routing-changes
+      - content: Download and install the specified Xray version. Pass "latest" for the
           newest release.
-        id: >-
-          download-and-install-the-specified-xray-version-pass-latest-for-the-newest-release
-      - content: >-
-          Self-update the panel to the latest version. The server restarts on
+        id: download-and-install-the-specified-xray-version-pass-latest-for-the-newest-release
+      - content: Self-update the panel to the latest version. The server restarts on
           success.
-        id: >-
-          self-update-the-panel-to-the-latest-version-the-server-restarts-on-success
-      - content: >-
-          Toggle the panel update channel between stable and the rolling
+        id: self-update-the-panel-to-the-latest-version-the-server-restarts-on-success
+      - content: Toggle the panel update channel between stable and the rolling
           per-commit dev release. Only effective on dev builds.
-        id: >-
-          toggle-the-panel-update-channel-between-stable-and-the-rolling-per-commit-dev-release-only-effective-on-dev-builds
-      - content: >-
-          Refresh the default GeoIP / GeoSite data files. Body can include a
+        id: toggle-the-panel-update-channel-between-stable-and-the-rolling-per-commit-dev-release-only-effective-on-dev-builds
+      - content: Refresh the default GeoIP / GeoSite data files. Body can include a
           fileName, or use the /:fileName variant.
-        id: >-
-          refresh-the-default-geoip--geosite-data-files-body-can-include-a-filename-or-use-the-filename-variant
+        id: refresh-the-default-geoip--geosite-data-files-body-can-include-a-filename-or-use-the-filename-variant
       - content: Refresh a single Geo file by filename (e.g. geoip.dat, geosite.dat).
         id: refresh-a-single-geo-file-by-filename-eg-geoipdat-geositedat
       - content: Return the last N lines of the panel’s own log.
         id: return-the-last-n-lines-of-the-panels-own-log
       - content: Return the last N lines of the Xray process log.
         id: return-the-last-n-lines-of-the-xray-process-log
-      - content: >-
-          Restore the panel DB from an uploaded SQLite file (multipart form,
+      - content: Restore the panel DB from an uploaded SQLite file (multipart form,
           field name "db"). The panel restarts after restore. Destructive.
-        id: >-
-          restore-the-panel-db-from-an-uploaded-sqlite-file-multipart-form-field-name-db-the-panel-restarts-after-restore-destructive
-      - content: >-
-          Generate a new ECH (Encrypted Client Hello) keypair and config list
-          for the given SNI.
-        id: >-
-          generate-a-new-ech-encrypted-client-hello-keypair-and-config-list-for-the-given-sni
-      - content: >-
-          Compute the hex SHA-256 of a certificate (DER) for pinning
+        id: restore-the-panel-db-from-an-uploaded-sqlite-file-multipart-form-field-name-db-the-panel-restarts-after-restore-destructive
+      - content: Generate a new ECH (Encrypted Client Hello) keypair and config list for
+          the given SNI.
+        id: generate-a-new-ech-encrypted-client-hello-keypair-and-config-list-for-the-given-sni
+      - content: Compute the hex SHA-256 of a certificate (DER) for pinning
           (pinnedPeerCertSha256). Provide either a server file path or inline
           PEM/DER content.
-        id: >-
-          compute-the-hex-sha-256-of-a-certificate-der-for-pinning-pinnedpeercertsha256-provide-either-a-server-file-path-or-inline-pemder-content
-      - content: >-
-          Run `xray tls ping` against a remote server and return its live
+        id: compute-the-hex-sha-256-of-a-certificate-der-for-pinning-pinnedpeercertsha256-provide-either-a-server-file-path-or-inline-pemder-content
+      - content: Run `xray tls ping` against a remote server and return its live
           leaf-certificate SHA-256 hash(es) for pinning (pinnedPeerCertSha256).
-        id: >-
-          run-xray-tls-ping-against-a-remote-server-and-return-its-live-leaf-certificate-sha-256-hashes-for-pinning-pinnedpeercertsha256
-      - content: >-
-          Fetch the fully aggregated inbound_client_ips database table. Used by
+        id: run-xray-tls-ping-against-a-remote-server-and-return-its-live-leaf-certificate-sha-256-hashes-for-pinning-pinnedpeercertsha256
+      - content: Fetch the fully aggregated inbound_client_ips database table. Used by
           nodes to sync recently active IPs across the cluster.
-        id: >-
-          fetch-the-fully-aggregated-inbound_client_ips-database-table-used-by-nodes-to-sync-recently-active-ips-across-the-cluster
-      - content: >-
-          Submit a list of recently active IP timestamps. The panel merges them
+        id: fetch-the-fully-aggregated-inbound_client_ips-database-table-used-by-nodes-to-sync-recently-active-ips-across-the-cluster
+      - content: Submit a list of recently active IP timestamps. The panel merges them
           with the existing database to maintain a unified global IP-limit view.
-        id: >-
-          submit-a-list-of-recently-active-ip-timestamps-the-panel-merges-them-with-the-existing-database-to-maintain-a-unified-global-ip-limit-view
+        id: submit-a-list-of-recently-active-ip-timestamps-the-panel-merges-them-with-the-existing-database-to-maintain-a-unified-global-ip-limit-view
     contents: []
 ---
 

+ 37 - 70
docs/content/docs/en/reference/api/settings.mdx

@@ -1,7 +1,6 @@
 ---
 title: Settings
-description: >-
-  Panel configuration and user credentials. All endpoints live under
+description: Panel configuration and user credentials. All endpoints live under
   /panel/api/setting and require a logged-in session or Bearer token.
 full: true
 _openapi:
@@ -9,101 +8,69 @@ _openapi:
     - ./public/openapi.json
   toc:
     - depth: 2
-      title: >-
-        Return every panel setting: web server, Telegram bot, subscription,
-        security, LDAP. The full JSON blob that the Settings page edits.
-      url: >-
-        #return-every-panel-setting-web-server-telegram-bot-subscription-security-ldap-the-full-json-blob-that-the-settings-page-edits
+      title: 'Return every panel setting: web server, Telegram bot, subscription,
+        security, LDAP. The full JSON blob that the Settings page edits.'
+      url: '#return-every-panel-setting-web-server-telegram-bot-subscription-security-ldap-the-full-json-blob-that-the-settings-page-edits'
     - depth: 2
-      title: >-
-        Return the computed default settings based on the request host. Useful
-        to preview what a fresh install would use.
-      url: >-
-        #return-the-computed-default-settings-based-on-the-request-host-useful-to-preview-what-a-fresh-install-would-use
+      title: Return the computed default settings based on the request host. Useful to
+        preview what a fresh install would use.
+      url: '#return-the-computed-default-settings-based-on-the-request-host-useful-to-preview-what-a-fresh-install-would-use'
     - depth: 2
-      title: >-
-        Persist every setting at once. The body mirrors the shape returned by
+      title: Persist every setting at once. The body mirrors the shape returned by
         /all. Invalid values (bad ports, missing cert pairs, etc.) are rejected
         before write.
-      url: >-
-        #persist-every-setting-at-once-the-body-mirrors-the-shape-returned-by-all-invalid-values-bad-ports-missing-cert-pairs-etc-are-rejected-before-write
+      url: '#persist-every-setting-at-once-the-body-mirrors-the-shape-returned-by-all-invalid-values-bad-ports-missing-cert-pairs-etc-are-rejected-before-write'
     - depth: 2
-      title: >-
-        Change the panel admin username and password. Requires the current
+      title: Change the panel admin username and password. Requires the current
         credentials for verification. The session is refreshed with the new
         values on success.
-      url: >-
-        #change-the-panel-admin-username-and-password-requires-the-current-credentials-for-verification-the-session-is-refreshed-with-the-new-values-on-success
+      url: '#change-the-panel-admin-username-and-password-requires-the-current-credentials-for-verification-the-session-is-refreshed-with-the-new-values-on-success'
     - depth: 2
-      title: >-
-        Restart the entire 3x-ui process after a 3-second grace period. The
+      title: Restart the entire 3x-ui process after a 3-second grace period. The
         connection drops immediately; the panel comes back online ~5-10 seconds
         later.
-      url: >-
-        #restart-the-entire-3x-ui-process-after-a-3-second-grace-period-the-connection-drops-immediately-the-panel-comes-back-online-5-10-seconds-later
+      url: '#restart-the-entire-3x-ui-process-after-a-3-second-grace-period-the-connection-drops-immediately-the-panel-comes-back-online-5-10-seconds-later'
     - depth: 2
-      title: >-
-        Test SMTP connection with stage-by-stage reporting (connect, auth,
-        send). Returns structured result with stage and message.
-      url: >-
-        #test-smtp-connection-with-stage-by-stage-reporting-connect-auth-send-returns-structured-result-with-stage-and-message
+      title: Test SMTP connection with stage-by-stage reporting (connect, auth, send).
+        Returns structured result with stage and message.
+      url: '#test-smtp-connection-with-stage-by-stage-reporting-connect-auth-send-returns-structured-result-with-stage-and-message'
     - depth: 2
-      title: >-
-        Test Telegram bot connection by sending a test message to the configured
+      title: Test Telegram bot connection by sending a test message to the configured
         chat.
-      url: >-
-        #test-telegram-bot-connection-by-sending-a-test-message-to-the-configured-chat
+      url: '#test-telegram-bot-connection-by-sending-a-test-message-to-the-configured-chat'
     - depth: 2
-      title: >-
-        Return the built-in default Xray JSON config template that ships with
+      title: Return the built-in default Xray JSON config template that ships with
         this panel version.
-      url: >-
-        #return-the-built-in-default-xray-json-config-template-that-ships-with-this-panel-version
+      url: '#return-the-built-in-default-xray-json-config-template-that-ships-with-this-panel-version'
   structuredData:
     headings:
-      - content: >-
-          Return every panel setting: web server, Telegram bot, subscription,
-          security, LDAP. The full JSON blob that the Settings page edits.
-        id: >-
-          return-every-panel-setting-web-server-telegram-bot-subscription-security-ldap-the-full-json-blob-that-the-settings-page-edits
-      - content: >-
-          Return the computed default settings based on the request host. Useful
+      - content: 'Return every panel setting: web server, Telegram bot, subscription,
+          security, LDAP. The full JSON blob that the Settings page edits.'
+        id: return-every-panel-setting-web-server-telegram-bot-subscription-security-ldap-the-full-json-blob-that-the-settings-page-edits
+      - content: Return the computed default settings based on the request host. Useful
           to preview what a fresh install would use.
-        id: >-
-          return-the-computed-default-settings-based-on-the-request-host-useful-to-preview-what-a-fresh-install-would-use
-      - content: >-
-          Persist every setting at once. The body mirrors the shape returned by
+        id: return-the-computed-default-settings-based-on-the-request-host-useful-to-preview-what-a-fresh-install-would-use
+      - content: Persist every setting at once. The body mirrors the shape returned by
           /all. Invalid values (bad ports, missing cert pairs, etc.) are
           rejected before write.
-        id: >-
-          persist-every-setting-at-once-the-body-mirrors-the-shape-returned-by-all-invalid-values-bad-ports-missing-cert-pairs-etc-are-rejected-before-write
-      - content: >-
-          Change the panel admin username and password. Requires the current
+        id: persist-every-setting-at-once-the-body-mirrors-the-shape-returned-by-all-invalid-values-bad-ports-missing-cert-pairs-etc-are-rejected-before-write
+      - content: Change the panel admin username and password. Requires the current
           credentials for verification. The session is refreshed with the new
           values on success.
-        id: >-
-          change-the-panel-admin-username-and-password-requires-the-current-credentials-for-verification-the-session-is-refreshed-with-the-new-values-on-success
-      - content: >-
-          Restart the entire 3x-ui process after a 3-second grace period. The
+        id: change-the-panel-admin-username-and-password-requires-the-current-credentials-for-verification-the-session-is-refreshed-with-the-new-values-on-success
+      - content: Restart the entire 3x-ui process after a 3-second grace period. The
           connection drops immediately; the panel comes back online ~5-10
           seconds later.
-        id: >-
-          restart-the-entire-3x-ui-process-after-a-3-second-grace-period-the-connection-drops-immediately-the-panel-comes-back-online-5-10-seconds-later
-      - content: >-
-          Test SMTP connection with stage-by-stage reporting (connect, auth,
+        id: restart-the-entire-3x-ui-process-after-a-3-second-grace-period-the-connection-drops-immediately-the-panel-comes-back-online-5-10-seconds-later
+      - content: Test SMTP connection with stage-by-stage reporting (connect, auth,
           send). Returns structured result with stage and message.
-        id: >-
-          test-smtp-connection-with-stage-by-stage-reporting-connect-auth-send-returns-structured-result-with-stage-and-message
-      - content: >-
-          Test Telegram bot connection by sending a test message to the
+        id: test-smtp-connection-with-stage-by-stage-reporting-connect-auth-send-returns-structured-result-with-stage-and-message
+      - content: Test Telegram bot connection by sending a test message to the
           configured chat.
-        id: >-
-          test-telegram-bot-connection-by-sending-a-test-message-to-the-configured-chat
-      - content: >-
-          Return the built-in default Xray JSON config template that ships with
+        id: test-telegram-bot-connection-by-sending-a-test-message-to-the-configured-chat
+      - content: Return the built-in default Xray JSON config template that ships with
           this panel version.
-        id: >-
-          return-the-built-in-default-xray-json-config-template-that-ships-with-this-panel-version
+        id: return-the-built-in-default-xray-json-config-template-that-ships-with-this-panel-version
     contents: []
 ---
 

+ 23 - 36
docs/content/docs/en/reference/api/subscription-server.mdx

@@ -1,59 +1,46 @@
 ---
 title: Subscription Server
-description: >-
-  A separate HTTP/HTTPS server that serves proxy subscription links (standard,
-  JSON, and Clash) to clients. The server listens on its own port (default
-  10882) and is configured in Settings → Subscription. Paths are configurable;
-  defaults are shown below. All subscription endpoints set response headers for
-  client apps to read traffic/expiry info.
+description: A separate HTTP/HTTPS server that serves proxy subscription links
+  (standard, JSON, and Clash) to clients. The server listens on its own port
+  (default 10882) and is configured in Settings → Subscription. Paths are
+  configurable; defaults are shown below. All subscription endpoints set
+  response headers for client apps to read traffic/expiry info.
 full: true
 _openapi:
   preload:
     - ./public/openapi.json
   toc:
     - depth: 2
-      title: >-
-        Return base64-encoded subscription links for all enabled clients
+      title: 'Return base64-encoded subscription links for all enabled clients
         matching the subscription ID. When the request has an Accept: text/html
         header or ?html=1, renders a styled info page instead. Default path:
-        /sub/:subid.
-      url: >-
-        #return-base64-encoded-subscription-links-for-all-enabled-clients-matching-the-subscription-id-when-the-request-has-an-accept-texthtml-header-or-html1-renders-a-styled-info-page-instead-default-path-subsubid
+        /sub/:subid.'
+      url: '#return-base64-encoded-subscription-links-for-all-enabled-clients-matching-the-subscription-id-when-the-request-has-an-accept-texthtml-header-or-html1-renders-a-styled-info-page-instead-default-path-subsubid'
     - depth: 2
-      title: >-
-        Return subscription as a JSON array of proxy configs (one per enabled
+      title: 'Return subscription as a JSON array of proxy configs (one per enabled
         client). Only when JSON subscription is enabled in settings. Default
-        path: /json/:subid.
-      url: >-
-        #return-subscription-as-a-json-array-of-proxy-configs-one-per-enabled-client-only-when-json-subscription-is-enabled-in-settings-default-path-jsonsubid
+        path: /json/:subid.'
+      url: '#return-subscription-as-a-json-array-of-proxy-configs-one-per-enabled-client-only-when-json-subscription-is-enabled-in-settings-default-path-jsonsubid'
     - depth: 2
-      title: >-
-        Return subscription as a Clash/Mihomo-compatible YAML config, including
+      title: 'Return subscription as a Clash/Mihomo-compatible YAML config, including
         configured global Clash routing rules. Only when Clash subscription is
-        enabled in settings. Default path: /clash/:subid.
-      url: >-
-        #return-subscription-as-a-clashmihomo-compatible-yaml-config-including-configured-global-clash-routing-rules-only-when-clash-subscription-is-enabled-in-settings-default-path-clashsubid
+        enabled in settings. Default path: /clash/:subid.'
+      url: '#return-subscription-as-a-clashmihomo-compatible-yaml-config-including-configured-global-clash-routing-rules-only-when-clash-subscription-is-enabled-in-settings-default-path-clashsubid'
   structuredData:
     headings:
-      - content: >-
-          Return base64-encoded subscription links for all enabled clients
+      - content: 'Return base64-encoded subscription links for all enabled clients
           matching the subscription ID. When the request has an Accept:
           text/html header or ?html=1, renders a styled info page instead.
-          Default path: /sub/:subid.
-        id: >-
-          return-base64-encoded-subscription-links-for-all-enabled-clients-matching-the-subscription-id-when-the-request-has-an-accept-texthtml-header-or-html1-renders-a-styled-info-page-instead-default-path-subsubid
-      - content: >-
-          Return subscription as a JSON array of proxy configs (one per enabled
+          Default path: /sub/:subid.'
+        id: return-base64-encoded-subscription-links-for-all-enabled-clients-matching-the-subscription-id-when-the-request-has-an-accept-texthtml-header-or-html1-renders-a-styled-info-page-instead-default-path-subsubid
+      - content: 'Return subscription as a JSON array of proxy configs (one per enabled
           client). Only when JSON subscription is enabled in settings. Default
-          path: /json/:subid.
-        id: >-
-          return-subscription-as-a-json-array-of-proxy-configs-one-per-enabled-client-only-when-json-subscription-is-enabled-in-settings-default-path-jsonsubid
-      - content: >-
-          Return subscription as a Clash/Mihomo-compatible YAML config,
+          path: /json/:subid.'
+        id: return-subscription-as-a-json-array-of-proxy-configs-one-per-enabled-client-only-when-json-subscription-is-enabled-in-settings-default-path-jsonsubid
+      - content: 'Return subscription as a Clash/Mihomo-compatible YAML config,
           including configured global Clash routing rules. Only when Clash
-          subscription is enabled in settings. Default path: /clash/:subid.
-        id: >-
-          return-subscription-as-a-clashmihomo-compatible-yaml-config-including-configured-global-clash-routing-rules-only-when-clash-subscription-is-enabled-in-settings-default-path-clashsubid
+          subscription is enabled in settings. Default path: /clash/:subid.'
+        id: return-subscription-as-a-clashmihomo-compatible-yaml-config-including-configured-global-clash-routing-rules-only-when-clash-subscription-is-enabled-in-settings-default-path-clashsubid
     contents: []
 ---
 

+ 5 - 10
docs/content/docs/en/reference/api/websocket.mdx

@@ -1,7 +1,6 @@
 ---
 title: WebSocket
-description: >-
-  Real-time status updates via WebSocket. Connect once at
+description: Real-time status updates via WebSocket. Connect once at
   <code>ws://<panel>/ws</code> to receive a stream of JSON messages without
   polling. Requires an authenticated session cookie (Bearer token auth is not
   supported). Each message has a <code>type</code> field that identifies the
@@ -12,22 +11,18 @@ _openapi:
     - ./public/openapi.json
   toc:
     - depth: 2
-      title: >-
-        Upgrade an HTTP connection to a WebSocket. Requires an authenticated
+      title: Upgrade an HTTP connection to a WebSocket. Requires an authenticated
         session cookie (Bearer token auth is not supported here). Returns 101
         Switching Protocols on success. The server then pushes JSON messages
         described below.
-      url: >-
-        #upgrade-an-http-connection-to-a-websocket-requires-an-authenticated-session-cookie-bearer-token-auth-is-not-supported-here-returns-101-switching-protocols-on-success-the-server-then-pushes-json-messages-described-below
+      url: '#upgrade-an-http-connection-to-a-websocket-requires-an-authenticated-session-cookie-bearer-token-auth-is-not-supported-here-returns-101-switching-protocols-on-success-the-server-then-pushes-json-messages-described-below'
   structuredData:
     headings:
-      - content: >-
-          Upgrade an HTTP connection to a WebSocket. Requires an authenticated
+      - content: Upgrade an HTTP connection to a WebSocket. Requires an authenticated
           session cookie (Bearer token auth is not supported here). Returns 101
           Switching Protocols on success. The server then pushes JSON messages
           described below.
-        id: >-
-          upgrade-an-http-connection-to-a-websocket-requires-an-authenticated-session-cookie-bearer-token-auth-is-not-supported-here-returns-101-switching-protocols-on-success-the-server-then-pushes-json-messages-described-below
+        id: upgrade-an-http-connection-to-a-websocket-requires-an-authenticated-session-cookie-bearer-token-auth-is-not-supported-here-returns-101-switching-protocols-on-success-the-server-then-pushes-json-messages-described-below
     contents: []
 ---
 

+ 84 - 160
docs/content/docs/en/reference/api/xray-settings.mdx

@@ -1,50 +1,37 @@
 ---
 title: Xray Settings
-description: >-
-  Xray configuration template, outbound management, Warp/Nord integration, and
-  config testing. All endpoints under /panel/api/xray.
+description: Xray configuration template, outbound management, Warp/Nord
+  integration, and config testing. All endpoints under /panel/api/xray.
 full: true
 _openapi:
   preload:
     - ./public/openapi.json
   toc:
     - depth: 2
-      title: >-
-        Return the Xray config template (JSON string), available inbound tags,
+      title: Return the Xray config template (JSON string), available inbound tags,
         client reverse tags, and the configured outbound test URL in one
         response.
-      url: >-
-        #return-the-xray-config-template-json-string-available-inbound-tags-client-reverse-tags-and-the-configured-outbound-test-url-in-one-response
+      url: '#return-the-xray-config-template-json-string-available-inbound-tags-client-reverse-tags-and-the-configured-outbound-test-url-in-one-response'
     - depth: 2
-      title: >-
-        Return the built-in default Xray config shipped with the panel
-        (identical to /panel/api/setting/getDefaultJsonConfig).
-      url: >-
-        #return-the-built-in-default-xray-config-shipped-with-the-panel-identical-to-panelapisettinggetdefaultjsonconfig
+      title: Return the built-in default Xray config shipped with the panel (identical
+        to /panel/api/setting/getDefaultJsonConfig).
+      url: '#return-the-built-in-default-xray-config-shipped-with-the-panel-identical-to-panelapisettinggetdefaultjsonconfig'
     - depth: 2
-      title: >-
-        Return traffic statistics for every outbound. Each outbound shows
+      title: Return traffic statistics for every outbound. Each outbound shows
         up/down/total counters.
-      url: >-
-        #return-traffic-statistics-for-every-outbound-each-outbound-shows-updowntotal-counters
+      url: '#return-traffic-statistics-for-every-outbound-each-outbound-shows-updowntotal-counters'
     - depth: 2
-      title: >-
-        Return the most recent Xray process stdout/stderr output. Useful to
-        check for startup errors or runtime warnings.
-      url: >-
-        #return-the-most-recent-xray-process-stdoutstderr-output-useful-to-check-for-startup-errors-or-runtime-warnings
+      title: Return the most recent Xray process stdout/stderr output. Useful to check
+        for startup errors or runtime warnings.
+      url: '#return-the-most-recent-xray-process-stdoutstderr-output-useful-to-check-for-startup-errors-or-runtime-warnings'
     - depth: 2
-      title: >-
-        Save the Xray JSON config template and optionally the outbound test URL.
+      title: Save the Xray JSON config template and optionally the outbound test URL.
         Both are sent as form fields.
-      url: >-
-        #save-the-xray-json-config-template-and-optionally-the-outbound-test-url-both-are-sent-as-form-fields
+      url: '#save-the-xray-json-config-template-and-optionally-the-outbound-test-url-both-are-sent-as-form-fields'
     - depth: 2
-      title: >-
-        Manage Cloudflare Warp integration. The action parameter selects the
+      title: Manage Cloudflare Warp integration. The action parameter selects the
         operation.
-      url: >-
-        #manage-cloudflare-warp-integration-the-action-parameter-selects-the-operation
+      url: '#manage-cloudflare-warp-integration-the-action-parameter-selects-the-operation'
     - depth: 2
       title: Manage NordVPN integration. The action parameter selects the operation.
       url: '#manage-nordvpn-integration-the-action-parameter-selects-the-operation'
@@ -52,193 +39,130 @@ _openapi:
       title: Reset traffic counters for a specific outbound by tag.
       url: '#reset-traffic-counters-for-a-specific-outbound-by-tag'
     - depth: 2
-      title: >-
-        Test an outbound configuration. Sends the outbound JSON (required),
+      title: Test an outbound configuration. Sends the outbound JSON (required),
         optionally all outbounds (to resolve sockopt.dialerProxy dependencies),
         and a mode flag.
-      url: >-
-        #test-an-outbound-configuration-sends-the-outbound-json-required-optionally-all-outbounds-to-resolve-sockoptdialerproxy-dependencies-and-a-mode-flag
+      url: '#test-an-outbound-configuration-sends-the-outbound-json-required-optionally-all-outbounds-to-resolve-sockoptdialerproxy-dependencies-and-a-mode-flag'
     - depth: 2
-      title: >-
-        Test a batch of outbounds (max 50) through one shared temp xray
-        instance. Returns an array of results in input order, each with the
-        outbound tag, delay, HTTP status and a connect/TLS/TTFB timing
-        breakdown.
-      url: >-
-        #test-a-batch-of-outbounds-max-50-through-one-shared-temp-xray-instance-returns-an-array-of-results-in-input-order-each-with-the-outbound-tag-delay-http-status-and-a-connecttlsttfb-timing-breakdown
+      title: Test a batch of outbounds (max 50) through one shared temp xray instance.
+        Returns an array of results in input order, each with the outbound tag,
+        delay, HTTP status and a connect/TLS/TTFB timing breakdown.
+      url: '#test-a-batch-of-outbounds-max-50-through-one-shared-temp-xray-instance-returns-an-array-of-results-in-input-order-each-with-the-outbound-tag-delay-http-status-and-a-connecttlsttfb-timing-breakdown'
     - depth: 2
-      title: >-
-        Live state of routing balancers in the running core
+      title: 'Live state of routing balancers in the running core
         (RoutingService.GetBalancerInfo): current override and the targets the
-        strategy prefers. Returns a map keyed by balancer tag.
-      url: >-
-        #live-state-of-routing-balancers-in-the-running-core-routingservicegetbalancerinfo-current-override-and-the-targets-the-strategy-prefers-returns-a-map-keyed-by-balancer-tag
+        strategy prefers. Returns a map keyed by balancer tag.'
+      url: '#live-state-of-routing-balancers-in-the-running-core-routingservicegetbalancerinfo-current-override-and-the-targets-the-strategy-prefers-returns-a-map-keyed-by-balancer-tag'
     - depth: 2
-      title: >-
-        Force a balancer in the running core to always pick one outbound
+      title: Force a balancer in the running core to always pick one outbound
         (RoutingService.OverrideBalancerTarget). Applied live without a restart;
         cleared automatically when Xray restarts.
-      url: >-
-        #force-a-balancer-in-the-running-core-to-always-pick-one-outbound-routingserviceoverridebalancertarget-applied-live-without-a-restart-cleared-automatically-when-xray-restarts
+      url: '#force-a-balancer-in-the-running-core-to-always-pick-one-outbound-routingserviceoverridebalancertarget-applied-live-without-a-restart-cleared-automatically-when-xray-restarts'
     - depth: 2
-      title: >-
-        Ask the running core which outbound its router would pick for a
-        synthetic connection (RoutingService.TestRoute). No traffic is sent.
-      url: >-
-        #ask-the-running-core-which-outbound-its-router-would-pick-for-a-synthetic-connection-routingservicetestroute-no-traffic-is-sent
+      title: Ask the running core which outbound its router would pick for a synthetic
+        connection (RoutingService.TestRoute). No traffic is sent.
+      url: '#ask-the-running-core-which-outbound-its-router-would-pick-for-a-synthetic-connection-routingservicetestroute-no-traffic-is-sent'
     - depth: 2
-      title: >-
-        List all outbound subscriptions (remote URLs that supply additional
+      title: List all outbound subscriptions (remote URLs that supply additional
         outbounds), newest first.
-      url: >-
-        #list-all-outbound-subscriptions-remote-urls-that-supply-additional-outbounds-newest-first
+      url: '#list-all-outbound-subscriptions-remote-urls-that-supply-additional-outbounds-newest-first'
     - depth: 2
-      title: >-
-        Create an outbound subscription. The URL is fetched, parsed into
+      title: Create an outbound subscription. The URL is fetched, parsed into
         outbounds with stable tags, and merged additively into the running Xray
         config.
-      url: >-
-        #create-an-outbound-subscription-the-url-is-fetched-parsed-into-outbounds-with-stable-tags-and-merged-additively-into-the-running-xray-config
+      url: '#create-an-outbound-subscription-the-url-is-fetched-parsed-into-outbounds-with-stable-tags-and-merged-additively-into-the-running-xray-config'
     - depth: 2
-      title: >-
-        Update an existing outbound subscription by id. Accepts the same form
+      title: Update an existing outbound subscription by id. Accepts the same form
         fields as create.
-      url: >-
-        #update-an-existing-outbound-subscription-by-id-accepts-the-same-form-fields-as-create
+      url: '#update-an-existing-outbound-subscription-by-id-accepts-the-same-form-fields-as-create'
     - depth: 2
       title: Delete an outbound subscription by id.
       url: '#delete-an-outbound-subscription-by-id'
     - depth: 2
-      title: >-
-        Delete an outbound subscription by id (POST alias of DELETE for
+      title: Delete an outbound subscription by id (POST alias of DELETE for
         axios-friendly clients).
-      url: >-
-        #delete-an-outbound-subscription-by-id-post-alias-of-delete-for-axios-friendly-clients
+      url: '#delete-an-outbound-subscription-by-id-post-alias-of-delete-for-axios-friendly-clients'
     - depth: 2
-      title: >-
-        Force an immediate re-fetch of the subscription and return the parsed
+      title: Force an immediate re-fetch of the subscription and return the parsed
         outbounds. Signals Xray to reload.
-      url: >-
-        #force-an-immediate-re-fetch-of-the-subscription-and-return-the-parsed-outbounds-signals-xray-to-reload
+      url: '#force-an-immediate-re-fetch-of-the-subscription-and-return-the-parsed-outbounds-signals-xray-to-reload'
     - depth: 2
-      title: >-
-        Reorder a subscription one step up or down in priority (controls its
+      title: Reorder a subscription one step up or down in priority (controls its
         position in the merged outbounds).
-      url: >-
-        #reorder-a-subscription-one-step-up-or-down-in-priority-controls-its-position-in-the-merged-outbounds
+      url: '#reorder-a-subscription-one-step-up-or-down-in-priority-controls-its-position-in-the-merged-outbounds'
     - depth: 2
-      title: >-
-        Preview a subscription URL: fetch and parse it into outbounds without
-        persisting anything.
-      url: >-
-        #preview-a-subscription-url-fetch-and-parse-it-into-outbounds-without-persisting-anything
+      title: 'Preview a subscription URL: fetch and parse it into outbounds without
+        persisting anything.'
+      url: '#preview-a-subscription-url-fetch-and-parse-it-into-outbounds-without-persisting-anything'
   structuredData:
     headings:
-      - content: >-
-          Return the Xray config template (JSON string), available inbound tags,
+      - content: Return the Xray config template (JSON string), available inbound tags,
           client reverse tags, and the configured outbound test URL in one
           response.
-        id: >-
-          return-the-xray-config-template-json-string-available-inbound-tags-client-reverse-tags-and-the-configured-outbound-test-url-in-one-response
-      - content: >-
-          Return the built-in default Xray config shipped with the panel
+        id: return-the-xray-config-template-json-string-available-inbound-tags-client-reverse-tags-and-the-configured-outbound-test-url-in-one-response
+      - content: Return the built-in default Xray config shipped with the panel
           (identical to /panel/api/setting/getDefaultJsonConfig).
-        id: >-
-          return-the-built-in-default-xray-config-shipped-with-the-panel-identical-to-panelapisettinggetdefaultjsonconfig
-      - content: >-
-          Return traffic statistics for every outbound. Each outbound shows
+        id: return-the-built-in-default-xray-config-shipped-with-the-panel-identical-to-panelapisettinggetdefaultjsonconfig
+      - content: Return traffic statistics for every outbound. Each outbound shows
           up/down/total counters.
-        id: >-
-          return-traffic-statistics-for-every-outbound-each-outbound-shows-updowntotal-counters
-      - content: >-
-          Return the most recent Xray process stdout/stderr output. Useful to
+        id: return-traffic-statistics-for-every-outbound-each-outbound-shows-updowntotal-counters
+      - content: Return the most recent Xray process stdout/stderr output. Useful to
           check for startup errors or runtime warnings.
-        id: >-
-          return-the-most-recent-xray-process-stdoutstderr-output-useful-to-check-for-startup-errors-or-runtime-warnings
-      - content: >-
-          Save the Xray JSON config template and optionally the outbound test
+        id: return-the-most-recent-xray-process-stdoutstderr-output-useful-to-check-for-startup-errors-or-runtime-warnings
+      - content: Save the Xray JSON config template and optionally the outbound test
           URL. Both are sent as form fields.
-        id: >-
-          save-the-xray-json-config-template-and-optionally-the-outbound-test-url-both-are-sent-as-form-fields
-      - content: >-
-          Manage Cloudflare Warp integration. The action parameter selects the
-          operation.
-        id: >-
-          manage-cloudflare-warp-integration-the-action-parameter-selects-the-operation
-      - content: >-
-          Manage NordVPN integration. The action parameter selects the
+        id: save-the-xray-json-config-template-and-optionally-the-outbound-test-url-both-are-sent-as-form-fields
+      - content: Manage Cloudflare Warp integration. The action parameter selects the
           operation.
+        id: manage-cloudflare-warp-integration-the-action-parameter-selects-the-operation
+      - content: Manage NordVPN integration. The action parameter selects the operation.
         id: manage-nordvpn-integration-the-action-parameter-selects-the-operation
       - content: Reset traffic counters for a specific outbound by tag.
         id: reset-traffic-counters-for-a-specific-outbound-by-tag
-      - content: >-
-          Test an outbound configuration. Sends the outbound JSON (required),
+      - content: Test an outbound configuration. Sends the outbound JSON (required),
           optionally all outbounds (to resolve sockopt.dialerProxy
           dependencies), and a mode flag.
-        id: >-
-          test-an-outbound-configuration-sends-the-outbound-json-required-optionally-all-outbounds-to-resolve-sockoptdialerproxy-dependencies-and-a-mode-flag
-      - content: >-
-          Test a batch of outbounds (max 50) through one shared temp xray
+        id: test-an-outbound-configuration-sends-the-outbound-json-required-optionally-all-outbounds-to-resolve-sockoptdialerproxy-dependencies-and-a-mode-flag
+      - content: Test a batch of outbounds (max 50) through one shared temp xray
           instance. Returns an array of results in input order, each with the
           outbound tag, delay, HTTP status and a connect/TLS/TTFB timing
           breakdown.
-        id: >-
-          test-a-batch-of-outbounds-max-50-through-one-shared-temp-xray-instance-returns-an-array-of-results-in-input-order-each-with-the-outbound-tag-delay-http-status-and-a-connecttlsttfb-timing-breakdown
-      - content: >-
-          Live state of routing balancers in the running core
+        id: test-a-batch-of-outbounds-max-50-through-one-shared-temp-xray-instance-returns-an-array-of-results-in-input-order-each-with-the-outbound-tag-delay-http-status-and-a-connecttlsttfb-timing-breakdown
+      - content: 'Live state of routing balancers in the running core
           (RoutingService.GetBalancerInfo): current override and the targets the
-          strategy prefers. Returns a map keyed by balancer tag.
-        id: >-
-          live-state-of-routing-balancers-in-the-running-core-routingservicegetbalancerinfo-current-override-and-the-targets-the-strategy-prefers-returns-a-map-keyed-by-balancer-tag
-      - content: >-
-          Force a balancer in the running core to always pick one outbound
+          strategy prefers. Returns a map keyed by balancer tag.'
+        id: live-state-of-routing-balancers-in-the-running-core-routingservicegetbalancerinfo-current-override-and-the-targets-the-strategy-prefers-returns-a-map-keyed-by-balancer-tag
+      - content: Force a balancer in the running core to always pick one outbound
           (RoutingService.OverrideBalancerTarget). Applied live without a
           restart; cleared automatically when Xray restarts.
-        id: >-
-          force-a-balancer-in-the-running-core-to-always-pick-one-outbound-routingserviceoverridebalancertarget-applied-live-without-a-restart-cleared-automatically-when-xray-restarts
-      - content: >-
-          Ask the running core which outbound its router would pick for a
+        id: force-a-balancer-in-the-running-core-to-always-pick-one-outbound-routingserviceoverridebalancertarget-applied-live-without-a-restart-cleared-automatically-when-xray-restarts
+      - content: Ask the running core which outbound its router would pick for a
           synthetic connection (RoutingService.TestRoute). No traffic is sent.
-        id: >-
-          ask-the-running-core-which-outbound-its-router-would-pick-for-a-synthetic-connection-routingservicetestroute-no-traffic-is-sent
-      - content: >-
-          List all outbound subscriptions (remote URLs that supply additional
+        id: ask-the-running-core-which-outbound-its-router-would-pick-for-a-synthetic-connection-routingservicetestroute-no-traffic-is-sent
+      - content: List all outbound subscriptions (remote URLs that supply additional
           outbounds), newest first.
-        id: >-
-          list-all-outbound-subscriptions-remote-urls-that-supply-additional-outbounds-newest-first
-      - content: >-
-          Create an outbound subscription. The URL is fetched, parsed into
+        id: list-all-outbound-subscriptions-remote-urls-that-supply-additional-outbounds-newest-first
+      - content: Create an outbound subscription. The URL is fetched, parsed into
           outbounds with stable tags, and merged additively into the running
           Xray config.
-        id: >-
-          create-an-outbound-subscription-the-url-is-fetched-parsed-into-outbounds-with-stable-tags-and-merged-additively-into-the-running-xray-config
-      - content: >-
-          Update an existing outbound subscription by id. Accepts the same form
+        id: create-an-outbound-subscription-the-url-is-fetched-parsed-into-outbounds-with-stable-tags-and-merged-additively-into-the-running-xray-config
+      - content: Update an existing outbound subscription by id. Accepts the same form
           fields as create.
-        id: >-
-          update-an-existing-outbound-subscription-by-id-accepts-the-same-form-fields-as-create
+        id: update-an-existing-outbound-subscription-by-id-accepts-the-same-form-fields-as-create
       - content: Delete an outbound subscription by id.
         id: delete-an-outbound-subscription-by-id
-      - content: >-
-          Delete an outbound subscription by id (POST alias of DELETE for
+      - content: Delete an outbound subscription by id (POST alias of DELETE for
           axios-friendly clients).
-        id: >-
-          delete-an-outbound-subscription-by-id-post-alias-of-delete-for-axios-friendly-clients
-      - content: >-
-          Force an immediate re-fetch of the subscription and return the parsed
+        id: delete-an-outbound-subscription-by-id-post-alias-of-delete-for-axios-friendly-clients
+      - content: Force an immediate re-fetch of the subscription and return the parsed
           outbounds. Signals Xray to reload.
-        id: >-
-          force-an-immediate-re-fetch-of-the-subscription-and-return-the-parsed-outbounds-signals-xray-to-reload
-      - content: >-
-          Reorder a subscription one step up or down in priority (controls its
+        id: force-an-immediate-re-fetch-of-the-subscription-and-return-the-parsed-outbounds-signals-xray-to-reload
+      - content: Reorder a subscription one step up or down in priority (controls its
           position in the merged outbounds).
-        id: >-
-          reorder-a-subscription-one-step-up-or-down-in-priority-controls-its-position-in-the-merged-outbounds
-      - content: >-
-          Preview a subscription URL: fetch and parse it into outbounds without
-          persisting anything.
-        id: >-
-          preview-a-subscription-url-fetch-and-parse-it-into-outbounds-without-persisting-anything
+        id: reorder-a-subscription-one-step-up-or-down-in-priority-controls-its-position-in-the-merged-outbounds
+      - content: 'Preview a subscription URL: fetch and parse it into outbounds without
+          persisting anything.'
+        id: preview-a-subscription-url-fetch-and-parse-it-into-outbounds-without-persisting-anything
     contents: []
 ---
 

+ 22 - 22
docs/custom-subscription-templates.md

@@ -22,28 +22,28 @@ The panel uses standard Go `html/template` to render the subscription page.
 
 When rendering the template, the following variables are injected into the template context (`{{ .variable }}`):
 
-* `{{ .sId }}`: Subscription ID (UUID).
-* `{{ .enabled }}`: Whether the subscription/client is enabled (boolean).
-* `{{ .isOnline }}`: Whether the subscription's client has a live connection right now (boolean). Computed from the panel's online-client tracking (local Xray plus any remote nodes) at render time.
-* `{{ .download }}`: Formatted download traffic (e.g. "2.5 GB").
-* `{{ .upload }}`: Formatted upload traffic.
-* `{{ .total }}`: Formatted total traffic limit.
-* `{{ .used }}`: Formatted used traffic (download + upload).
-* `{{ .remained }}`: Formatted remaining traffic.
-* `{{ .expire }}`: Expiration time as an int64 Unix timestamp in **seconds** (`0` means never). Multiply by 1000 for a JavaScript `Date`.
-* `{{ .lastOnline }}`: Last online time as an int64 Unix timestamp in **milliseconds** (`0` means never seen).
-* `{{ .downloadByte }}`: Download traffic in exact bytes (int64).
-* `{{ .uploadByte }}`: Upload traffic in exact bytes (int64).
-* `{{ .totalByte }}`: Total traffic limit in exact bytes (int64).
-* `{{ .subUrl }}`: The URL of the subscription page.
-* `{{ .subJsonUrl }}`: The URL for the JSON configuration of the subscription.
-* `{{ .subClashUrl }}`: The URL for the Clash/Mihomo configuration.
-* `{{ .subTitle }}`: The subscription title configured in the panel (Subscription → Information). Useful for page branding/headings. May be empty.
-* `{{ .subSupportUrl }}`: The support URL configured in the panel. Useful for a "Contact support" link. May be empty.
-* `{{ .links }}`: A list (slice) of string configurations (VMess, VLESS, etc. URLs). You can loop through them using `{{ range .links }} ... {{ end }}`.
-* `{{ .emails }}`: A list (slice) of client emails, parallel to `links` — the email at index *i* owns the link at index *i*. May contain duplicates when one client has several links.
-* `{{ .announce }}`: The announcement text configured in the panel (Settings → Subscription → Announce). May be empty.
-* `{{ .datepicker }}`: Current calendar format used by the panel (e.g. "gregorian" or "jalali").
+- `{{ .sId }}`: Subscription ID (UUID).
+- `{{ .enabled }}`: Whether the subscription/client is enabled (boolean).
+- `{{ .isOnline }}`: Whether the subscription's client has a live connection right now (boolean). Computed from the panel's online-client tracking (local Xray plus any remote nodes) at render time.
+- `{{ .download }}`: Formatted download traffic (e.g. "2.5 GB").
+- `{{ .upload }}`: Formatted upload traffic.
+- `{{ .total }}`: Formatted total traffic limit.
+- `{{ .used }}`: Formatted used traffic (download + upload).
+- `{{ .remained }}`: Formatted remaining traffic.
+- `{{ .expire }}`: Expiration time as an int64 Unix timestamp in **seconds** (`0` means never). Multiply by 1000 for a JavaScript `Date`.
+- `{{ .lastOnline }}`: Last online time as an int64 Unix timestamp in **milliseconds** (`0` means never seen).
+- `{{ .downloadByte }}`: Download traffic in exact bytes (int64).
+- `{{ .uploadByte }}`: Upload traffic in exact bytes (int64).
+- `{{ .totalByte }}`: Total traffic limit in exact bytes (int64).
+- `{{ .subUrl }}`: The URL of the subscription page.
+- `{{ .subJsonUrl }}`: The URL for the JSON configuration of the subscription.
+- `{{ .subClashUrl }}`: The URL for the Clash/Mihomo configuration.
+- `{{ .subTitle }}`: The subscription title configured in the panel (Subscription → Information). Useful for page branding/headings. May be empty.
+- `{{ .subSupportUrl }}`: The support URL configured in the panel. Useful for a "Contact support" link. May be empty.
+- `{{ .links }}`: A list (slice) of string configurations (VMess, VLESS, etc. URLs). You can loop through them using `{{ range .links }} ... {{ end }}`.
+- `{{ .emails }}`: A list (slice) of client emails, parallel to `links` — the email at index _i_ owns the link at index _i_. May contain duplicates when one client has several links.
+- `{{ .announce }}`: The announcement text configured in the panel (Settings → Subscription → Announce). May be empty.
+- `{{ .datepicker }}`: Current calendar format used by the panel (e.g. "gregorian" or "jalali").
 
 ## Live Status JSON (`?format=info`)
 

+ 0 - 21
docs/eslint.config.mjs

@@ -1,21 +0,0 @@
-import coreWebVitals from 'eslint-config-next/core-web-vitals';
-import typescript from 'eslint-config-next/typescript';
-
-/** @type {import('eslint').Linter.Config[]} */
-const config = [
-  {
-    ignores: [
-      '.next/**',
-      '.source/**',
-      'out/**',
-      'node_modules/**',
-      'next-env.d.ts',
-      // Generated API reference pages (fumadocs-openapi output)
-      'content/docs/**/reference/api/**',
-    ],
-  },
-  ...coreWebVitals,
-  ...typescript,
-];
-
-export default config;

+ 8 - 1
docs/lib/layout.shared.tsx

@@ -3,7 +3,14 @@ import { Heart } from 'lucide-react';
 import { Logo } from '@/components/logo';
 import { TelegramIcon } from '@/components/icons';
 import { DocsThemeSwitch } from '@/components/theme-switch';
-import { appName, productRepoUrl, telegramChannel, telegramChannelUrl, donateUrl, siteUrl } from './shared';
+import {
+  appName,
+  productRepoUrl,
+  telegramChannel,
+  telegramChannelUrl,
+  donateUrl,
+  siteUrl,
+} from './shared';
 import { getSiteMessages } from './site-i18n';
 
 // Build locale-aware shared layout options. With `hideLocale: 'default-locale'`,

+ 2 - 1
docs/lib/site-i18n.ts

@@ -222,7 +222,8 @@ const zh: SiteMessages = {
     },
     {
       title: '自托管且可脚本化',
-      description: '单个 Go 二进制文件或 Docker 镜像、SQLite/PostgreSQL 后端,以及用于自动化的完整 REST API。',
+      description:
+        '单个 Go 二进制文件或 Docker 镜像、SQLite/PostgreSQL 后端,以及用于自动化的完整 REST API。',
     },
   ],
   licenseBefore: '基于 ',

+ 20 - 6
docs/lib/xray/api-client.test.ts

@@ -31,7 +31,7 @@ const base = {
 describe('buildCurl', () => {
   it('GET emits the Bearer header, a single-quoted URL, and no body flag', () => {
     const cmd = buildCurl({ ...base, method: 'GET' });
-    expect(cmd).toContain("-X GET");
+    expect(cmd).toContain('-X GET');
     expect(cmd).toContain("-H 'Authorization: Bearer TKN'");
     expect(cmd).toContain("'https://panel.example.com:2053/panel/api/inbounds/list'");
     expect(cmd).not.toContain('--data');
@@ -39,14 +39,23 @@ describe('buildCurl', () => {
   });
 
   it('POST with a body emits --data and a JSON content type', () => {
-    const cmd = buildCurl({ ...base, method: 'POST', path: '/panel/api/inbounds/add', body: '{"up":0}' });
+    const cmd = buildCurl({
+      ...base,
+      method: 'POST',
+      path: '/panel/api/inbounds/add',
+      body: '{"up":0}',
+    });
     expect(cmd).toContain('-X POST');
-    expect(cmd).toContain("--data '{\"up\":0}'");
-    expect(cmd).toContain("Content-Type: application/json");
+    expect(cmd).toContain('--data \'{"up":0}\'');
+    expect(cmd).toContain('Content-Type: application/json');
   });
 
   it('POST without a body omits --data', () => {
-    const cmd = buildCurl({ ...base, method: 'POST', path: '/panel/api/inbounds/resetAllTraffics' });
+    const cmd = buildCurl({
+      ...base,
+      method: 'POST',
+      path: '/panel/api/inbounds/resetAllTraffics',
+    });
     expect(cmd).not.toContain('--data');
   });
 });
@@ -60,7 +69,12 @@ describe('buildFetchSnippet', () => {
   });
 
   it('POST with a body includes a JSON.stringify body', () => {
-    const snip = buildFetchSnippet({ ...base, method: 'POST', path: '/panel/api/inbounds/add', body: '{"up":0}' });
+    const snip = buildFetchSnippet({
+      ...base,
+      method: 'POST',
+      path: '/panel/api/inbounds/add',
+      body: '{"up":0}',
+    });
     expect(snip).toContain("method: 'POST'");
     expect(snip).toContain('body: JSON.stringify(');
   });

+ 6 - 1
docs/lib/xray/outbounds.test.ts

@@ -160,7 +160,12 @@ describe('buildOutbound — wireguard & warp', () => {
     const ob = buildOutbound({
       kind: 'wireguard',
       tag: 'wg',
-      wireguard: { secretKey: 'sk', address: ['10.0.0.2/32'], publicKey: 'pk', endpoint: 'host:51820' },
+      wireguard: {
+        secretKey: 'sk',
+        address: ['10.0.0.2/32'],
+        publicKey: 'pk',
+        endpoint: 'host:51820',
+      },
     });
     const s = ob.settings as Record<string, unknown>;
     expect(s.secretKey).toBe('sk');

+ 5 - 1
docs/lib/xray/outbounds.ts

@@ -162,7 +162,11 @@ function buildSettings(o: OutboundInput): Record<string, unknown> {
         ],
       };
     case 'trojan':
-      return { servers: [{ address: s?.address ?? '', port: toPort(s?.port), password: s?.password ?? '' }] };
+      return {
+        servers: [
+          { address: s?.address ?? '', port: toPort(s?.port), password: s?.password ?? '' },
+        ],
+      };
     case 'shadowsocks':
       return {
         servers: [

+ 6 - 1
docs/lib/xray/routing.test.ts

@@ -18,7 +18,12 @@ describe('buildBalancer', () => {
   });
 
   it('includes fallbackTag when set', () => {
-    const b = buildBalancer({ tag: 'lb', selector: ['a'], strategy: 'random', fallbackTag: 'direct' });
+    const b = buildBalancer({
+      tag: 'lb',
+      selector: ['a'],
+      strategy: 'random',
+      fallbackTag: 'direct',
+    });
     expect(b.fallbackTag).toBe('direct');
   });
 });

+ 4 - 1
docs/lib/xray/routing.ts

@@ -121,7 +121,10 @@ export function buildRouting(input: RoutingInput): Record<string, unknown> {
   if (input.observatory) {
     Object.assign(out, buildObservatory(input.observatory));
   } else if (input.balancers.some((b) => b.strategy === 'leastLoad')) {
-    Object.assign(out, buildObservatory({ mode: 'burst', subjectSelector: uniqueSelectors(input.balancers) }));
+    Object.assign(
+      out,
+      buildObservatory({ mode: 'burst', subjectSelector: uniqueSelectors(input.balancers) }),
+    );
   } else if (input.balancers.some((b) => b.strategy === 'leastPing')) {
     Object.assign(
       out,

+ 10 - 2
docs/lib/xray/subscription.ts

@@ -214,12 +214,20 @@ function proxyOutbound(c: SubClient): Record<string, unknown> {
       };
       break;
     case 'trojan':
-      settings = { servers: [{ address: c.address, port: c.port, password: c.password ?? '', level: 8 }] };
+      settings = {
+        servers: [{ address: c.address, port: c.port, password: c.password ?? '', level: 8 }],
+      };
       break;
     case 'ss':
       settings = {
         servers: [
-          { address: c.address, port: c.port, password: c.password ?? '', level: 8, method: c.method || '' },
+          {
+            address: c.address,
+            port: c.port,
+            password: c.password ?? '',
+            level: 8,
+            method: c.method || '',
+          },
         ],
       };
       break;

+ 12 - 5
docs/lib/xray/telegram.test.ts

@@ -36,7 +36,10 @@ describe('parseAdminIds', () => {
   });
 
   it('accepts negative group ids and captures invalid entries', () => {
-    expect(parseAdminIds('-1001234567, abc, 42')).toEqual({ ids: [-1001234567, 42], invalid: ['abc'] });
+    expect(parseAdminIds('-1001234567, abc, 42')).toEqual({
+      ids: [-1001234567, 42],
+      invalid: ['abc'],
+    });
   });
 
   it('returns empty for blank input', () => {
@@ -78,9 +81,9 @@ describe('telegramApiBase', () => {
 
 describe('renderMessageTemplate', () => {
   it('substitutes known variables', () => {
-    expect(renderMessageTemplate('Host {{host}} up {{uptime}}', { host: 'srv', uptime: '3d' })).toBe(
-      'Host srv up 3d',
-    );
+    expect(
+      renderMessageTemplate('Host {{host}} up {{uptime}}', { host: 'srv', uptime: '3d' }),
+    ).toBe('Host srv up 3d');
   });
 
   it('leaves unknown variables literal', () => {
@@ -90,7 +93,11 @@ describe('renderMessageTemplate', () => {
 
 describe('buildBotConfigSummary', () => {
   it('emits the panel settings keys with admin ids joined', () => {
-    const s = buildBotConfigSummary({ token: VALID_TOKEN, adminIds: '111, 222', runTime: '@daily' });
+    const s = buildBotConfigSummary({
+      token: VALID_TOKEN,
+      adminIds: '111, 222',
+      runTime: '@daily',
+    });
     expect(s.tgBotEnable).toBe(true);
     expect(s.tgBotToken).toBe(VALID_TOKEN);
     expect(s.tgBotChatId).toBe('111,222');

+ 4 - 1
docs/lib/xray/telegram.ts

@@ -43,7 +43,10 @@ export function validateBotToken(token: string): TokenValidation {
 export function parseAdminIds(raw: string): AdminIdsResult {
   const ids: number[] = [];
   const invalid: string[] = [];
-  for (const part of raw.split(',').map((s) => s.trim()).filter(Boolean)) {
+  for (const part of raw
+    .split(',')
+    .map((s) => s.trim())
+    .filter(Boolean)) {
     // Telegram chat ids are integers; group/channel ids are negative.
     if (/^-?\d+$/.test(part)) ids.push(Number(part));
     else invalid.push(part);

+ 16 - 19
docs/package.json

@@ -11,28 +11,27 @@
     "postinstall": "fumadocs-mdx",
     "gen:api": "node scripts/gen-openapi.ts",
     "typecheck": "fumadocs-mdx && next typegen && tsc --noEmit",
-    "lint": "eslint .",
-    "format": "prettier --write .",
-    "format:check": "prettier --check .",
+    "lint": "oxlint .",
+    "format": "oxfmt .",
+    "format:check": "oxfmt --check .",
     "test": "vitest run",
     "test:watch": "vitest"
   },
   "dependencies": {
-    "@orama/orama": "^3.1.18",
-    "fumadocs-core": "^16.14.3",
+    "fumadocs-core": "^16.14.5",
     "fumadocs-docgen": "^3.1.0",
-    "fumadocs-mdx": "^15.2.3",
-    "fumadocs-openapi": "^11.2.3",
-    "fumadocs-ui": "^16.14.3",
-    "lucide-react": "^1.31.0",
-    "mermaid": "^11.16.1",
-    "next": "16.3.0",
+    "fumadocs-mdx": "^15.3.0",
+    "fumadocs-openapi": "^11.2.4",
+    "fumadocs-ui": "^16.14.5",
+    "lucide-react": "^1.33.0",
+    "mermaid": "^11.17.0",
+    "next": "16.3.1",
     "next-themes": "^0.4.6",
     "react": "^19.2.8",
     "react-dom": "^19.2.8",
     "react-qr-code": "^2.2.0",
     "tailwind-merge": "^3.6.0",
-    "zbsearch": "3.3.4",
+    "zbsearch": "4.0.0",
     "zod": "^4.4.3"
   },
   "devDependencies": {
@@ -41,14 +40,12 @@
     "@types/node": "^26.2.0",
     "@types/react": "^19.2.18",
     "@types/react-dom": "^19.2.4",
-    "eslint": "^9.39.5",
-    "eslint-config-next": "16.3.0",
-    "eslint-plugin-react": "^7.37.5",
+    "oxfmt": "0.64.0",
+    "oxlint": "1.79.0",
     "postcss": "^8.5.26",
-    "prettier": "^3.9.6",
     "tailwindcss": "^4.3.3",
-    "typescript": "6.0.3",
-    "vitest": "^4.1.10"
+    "typescript": "7.0.2",
+    "vitest": "^4.1.11"
   },
-  "packageManager": "[email protected]1.0+sha512.521705bce689924eac72f5a3587122f362689ef6571e55ba80076fd637c11132ecffada26fad4ea79c485bfddbfd3d5a2a5b05805a77e893de71ec8a6cca3bb1"
+  "packageManager": "[email protected]2.0+sha512.1ff870c4c6133dfd88fb2afc46dd13d47f09c9794b438c6fdb47ca98caf3bc16381ee0be93a091b8e3824cf01f889f46d7d9e20910fb0be1ab0fb5baa80dd621"
 }

Rozdielové dáta súboru neboli zobrazené, pretože súbor je príliš veľký
+ 417 - 470
docs/pnpm-lock.yaml


+ 4 - 5
docs/pnpm-workspace.yaml

@@ -8,9 +8,8 @@ overrides:
   'postcss@<8.5.10': '^8.5.15'
   'sharp@<0.35.0': '^0.35.3'
 minimumReleaseAgeExclude:
-  - '@mermaid-js/[email protected]'
-  - [email protected]
-  - [email protected]
-  - [email protected]
-  - [email protected]
+  - '@mermaid-js/[email protected]'
+  - [email protected]
+  - [email protected]
   - [email protected]
+  - [email protected]

+ 10 - 10
docs/real-client-ip.md

@@ -14,11 +14,11 @@ list, and multi-node sync — so once it is set, everything downstream just work
 Open an inbound → **Transport / Stream Settings** → enable **Sockopt** → use the
 **Real client IP** preset selector:
 
-| Preset | What it does | Use for |
-|---|---|---|
-| **Off / direct** | Clears both fields. | Inbound reachable directly by clients. |
-| **Cloudflare CDN** | Sets `sockopt.trustedXForwardedFor = ["CF-Connecting-IP"]`. | WebSocket / HTTPUpgrade / XHTTP behind Cloudflare's CDN (orange cloud). |
-| **L4 relay / Spectrum (PROXY)** | Sets `acceptProxyProtocol = true`. | An L4 tunnel/relay in front, or Cloudflare **Spectrum**. |
+| Preset                          | What it does                                                | Use for                                                                 |
+| ------------------------------- | ----------------------------------------------------------- | ----------------------------------------------------------------------- |
+| **Off / direct**                | Clears both fields.                                         | Inbound reachable directly by clients.                                  |
+| **Cloudflare CDN**              | Sets `sockopt.trustedXForwardedFor = ["CF-Connecting-IP"]`. | WebSocket / HTTPUpgrade / XHTTP behind Cloudflare's CDN (orange cloud). |
+| **L4 relay / Spectrum (PROXY)** | Sets `acceptProxyProtocol = true`.                          | An L4 tunnel/relay in front, or Cloudflare **Spectrum**.                |
 
 The raw `Proxy Protocol` switch and `Trusted X-Forwarded-For` list stay visible below the preset
 selector for manual / advanced tuning — the presets just fill them in for you.
@@ -65,16 +65,16 @@ and XHTTP; **not** on mKCP. The front must be configured to send the header, e.g
 
 ## Transport support matrix
 
-| Mechanism | TCP/RAW | mKCP | WebSocket | gRPC | HTTPUpgrade | XHTTP |
-|---|:--:|:--:|:--:|:--:|:--:|:--:|
-| `trustedXForwardedFor` (header) | – | – | ✅ | – | ✅ | ✅ |
-| `acceptProxyProtocol` (PROXY)   | ✅ | – | ✅ | ✅ | ✅ | ✅ |
+| Mechanism                       | TCP/RAW | mKCP | WebSocket | gRPC | HTTPUpgrade | XHTTP |
+| ------------------------------- | :-----: | :--: | :-------: | :--: | :---------: | :---: |
+| `trustedXForwardedFor` (header) |       |    |        |    |          |     |
+| `acceptProxyProtocol` (PROXY)   |      |    |         |    |          |     |
 
 The form shows a warning when you select a preset that the current transport cannot honor.
 
 > **Use one, not both.** `acceptProxyProtocol` and `trustedXForwardedFor` are independent — the
 > first reads the real IP from the L4 PROXY header, the second from an HTTP request header. On
-> WebSocket / HTTPUpgrade / XHTTP, xray applies the HTTP header *last*, so a stale
+> WebSocket / HTTPUpgrade / XHTTP, xray applies the HTTP header _last_, so a stale
 > `trustedXForwardedFor` would override (and defeat) a PROXY-protocol setup. The presets are
 > mutually exclusive and clear the other field for you; only mix them by hand if you know your
 > upstream chain needs it.

+ 14 - 0
frontend/.oxfmtrc.json

@@ -0,0 +1,14 @@
+{
+  "$schema": "./node_modules/oxfmt/configuration_schema.json",
+  "semi": true,
+  "singleQuote": true,
+  "trailingComma": "all",
+  "printWidth": 100,
+  "tabWidth": 2,
+  "ignorePatterns": [
+    "node_modules",
+    "src/generated",
+    "public",
+    "tools/oxlint/__fixtures__"
+  ]
+}

+ 72 - 0
frontend/.oxlintrc.json

@@ -0,0 +1,72 @@
+{
+  "$schema": "./node_modules/oxlint/configuration_schema.json",
+  "ignorePatterns": [
+    "node_modules/**"
+  ],
+  "plugins": [
+    "typescript",
+    "react",
+    "jsx-a11y"
+  ],
+  "jsPlugins": [
+    "./tools/oxlint/input-number-guard.mjs"
+  ],
+  "categories": {
+    "correctness": "error"
+  },
+  "env": {
+    "browser": true,
+    "es2022": true
+  },
+  "rules": {
+    "typescript/no-explicit-any": "error",
+    "typescript/no-unused-vars": [
+      "warn",
+      {
+        "argsIgnorePattern": "^_",
+        "varsIgnorePattern": "^_",
+        "caughtErrorsIgnorePattern": "^_"
+      }
+    ],
+    "typescript/ban-ts-comment": "error",
+    "typescript/no-empty-object-type": "error",
+    "typescript/no-namespace": "error",
+    "typescript/no-require-imports": "error",
+    "typescript/no-this-alias": "error",
+    "typescript/no-unsafe-function-type": "error",
+    "typescript/no-unused-expressions": "warn",
+    "typescript/no-wrapper-object-types": "error",
+    "typescript/prefer-as-const": "error",
+    "typescript/triple-slash-reference": "error",
+    "no-empty": [
+      "error",
+      {
+        "allowEmptyCatch": true
+      }
+    ],
+    "react-hooks/rules-of-hooks": "error",
+    "react-hooks/exhaustive-deps": "error",
+    "jsx-a11y/no-autofocus": "off",
+    "input-number/no-synthetic-clear": "off",
+    "jsx-a11y/prefer-tag-over-role": "off"
+  },
+  "overrides": [
+    {
+      "files": [
+        "src/pages/settings/**/*.tsx",
+        "src/pages/xray/**/*.tsx"
+      ],
+      "rules": {
+        "input-number/no-synthetic-clear": "error"
+      }
+    },
+    {
+      "files": [
+        "src/pages/xray/**/*Modal.tsx"
+      ],
+      "rules": {
+        "input-number/no-synthetic-clear": "off"
+      }
+    }
+  ]
+}

+ 1 - 1
frontend/CLAUDE.md

@@ -33,7 +33,7 @@ The `@` import alias maps to `src/`.
 - Function components + hooks only; no class components.
 - Comments in committed TS/TSX: 2 lines MAX per comment block, spent on the
   *why* a name cannot hold (same rule as root CLAUDE.md). HTML comments are fine.
-- TS strict; `no-explicit-any` is an error. Build forms with `useZodForm` +
+- TS strict; oxlint's `typescript/no-explicit-any` is an error. Build forms with `useZodForm` +
   `FormField` from `@/components/form/rhf` (wrap the tree in `FormProvider`);
   validate through the `zodResolver` or per-field
   `rules={{ validate: rhfZodValidate(Schema.shape.field) }}` — messages are Zod

+ 18 - 11
frontend/README.md

@@ -33,7 +33,10 @@ production-style links work without round-tripping through Go.
 | `npm run build` | Regenerates OpenAPI + Zod, then builds into `../internal/web/dist/` |
 | `npm run preview` | Serve the built bundle locally |
 | `npm run typecheck` | `tsc --noEmit` (strict, no emit) |
-| `npm run lint` | ESLint flat config (`@typescript-eslint` + `react-hooks`) |
+| `npm run lint` | oxlint over `src/` + `tools/` (`.oxlintrc.json`) |
+| `npm run lint:deprecated` | Type-aware sweep for JSDoc `@deprecated` APIs (on demand) |
+| `npm run format` | oxfmt (`.oxfmtrc.json`) — rewrites `src/` + `tools/` in place |
+| `npm run format:check` | oxfmt in check mode (no writes) |
 | `npm run test` | Vitest single run (schema fixtures, link parsers, …) |
 | `npm run test:watch` | Vitest watch mode |
 | `npm run storybook` | Storybook dev server on `:6006` (component workbench + autodocs) |
@@ -41,8 +44,8 @@ production-style links work without round-tripping through Go.
 | `npm run gen:api` | Build `public/openapi.json` from `pages/api-docs/endpoints.ts` |
 | `npm run gen:zod` | Run the Go-side openapigen tool → `src/generated/{zod,types}.ts` |
 
-CI runs `typecheck`, `lint`, `test`, `build`, and `build-storybook` on
-every PR (see `../.github/workflows/ci.yml`).
+CI runs `typecheck`, `lint`, `format:check`, `test`, `build`, and
+`build-storybook` on every PR (see `../.github/workflows/ci.yml`).
 
 ### One-off: scan for deprecated APIs
 
@@ -51,12 +54,13 @@ with the JSDoc `@deprecated` tag (AntD prop renames, Zod renames,
 removed Web APIs, etc.):
 
 ```sh
-npx eslint --config eslint.deprecated.config.js src
+npm run lint:deprecated
 ```
 
-It's a type-aware ESLint run against `eslint.deprecated.config.js`
-and is not wired into `npm run lint` because typed linting triples
-the wall-clock time.
+It is oxlint's type-aware mode (`oxlint-tsgolint`, which drives the
+TypeScript 7 `typescript-go` checker) narrowed to `no-deprecated`, and
+is not wired into `npm run lint` because typed linting needs a full
+type-check pass.
 
 ## Production build
 
@@ -85,9 +89,12 @@ normal network requests.
 frontend/
 ├── index.html, login.html, subpage.html  # 3 Vite entries
 ├── tsconfig.json
-├── eslint.config.js
-├── eslint.deprecated.config.js           # On-demand type-aware lint config that flags
-│                                         #   usages of APIs marked with JSDoc @deprecated
+├── .oxlintrc.json                        # oxlint config (replaces the ESLint flat config)
+├── .oxfmtrc.json                         # oxfmt config (Prettier-compatible settings)
+├── tools/oxlint/
+│   └── input-number-guard.mjs            # oxlint JS plugin: the #6121/#6127 cleared-
+│                                         #   InputNumber guard (oxlint has no
+│                                         #   no-restricted-syntax)
 ├── vitest.config.ts
 ├── vite.config.js
 ├── .storybook/                           # Storybook config (main.ts, preview.tsx)
@@ -155,7 +162,7 @@ Patterns:
   - Wire request: `Schema.parse(payload)` inside `mutationFn` — throws,
     because a malformed payload here is always a developer bug
 - **No `.loose()` or `[key: string]: any`** in production schemas.
-  `@typescript-eslint/no-explicit-any: error` is enforced.
+  `typescript/no-explicit-any: error` is enforced by oxlint.
 
 ## Form pattern (Pattern A)
 

+ 0 - 89
frontend/eslint.config.js

@@ -1,89 +0,0 @@
-import js from '@eslint/js';
-import tseslint from 'typescript-eslint';
-import reactHooks from 'eslint-plugin-react-hooks';
-import jsxA11y from 'eslint-plugin-jsx-a11y';
-import globals from 'globals';
-
-export default [
-  { ignores: ['node_modules/**', '../internal/web/dist/**'] },
-  js.configs.recommended,
-  ...tseslint.configs.recommended.map((config) => ({
-    ...config,
-    files: ['**/*.{ts,tsx}'],
-  })),
-  {
-    files: ['**/*.{ts,tsx}'],
-    plugins: {
-      'react-hooks': reactHooks,
-    },
-    languageOptions: {
-      ecmaVersion: 2022,
-      sourceType: 'module',
-      globals: {
-        ...globals.browser,
-      },
-    },
-    rules: {
-      ...reactHooks.configs.recommended.rules,
-      '@typescript-eslint/no-unused-vars': ['warn', {
-        argsIgnorePattern: '^_',
-        varsIgnorePattern: '^_',
-        caughtErrorsIgnorePattern: '^_',
-      }],
-      // Zod migration goal (Step 7): every production module is held to
-      // strict no-explicit-any. The two legacy class files at the bottom
-      // of the rule list keep their existing file-level eslint-disable
-      // until DBInbound is migrated off Inbound.toInbound() — see the
-      // migration spec Non-Goals section.
-      '@typescript-eslint/no-explicit-any': 'error',
-      'no-empty': ['error', { allowEmptyCatch: true }],
-      'react-hooks/set-state-in-effect': 'off',
-      'react-hooks/purity': 'off',
-      'react-hooks/react-compiler': 'off',
-      'react-hooks/preserve-manual-memoization': 'off',
-      'react-hooks/immutability': 'off',
-      'react-hooks/refs': 'off',
-    },
-  },
-  {
-    files: ['**/*.tsx'],
-    plugins: { 'jsx-a11y': jsxA11y },
-    rules: {
-      ...jsxA11y.flatConfigs.recommended.rules,
-      'jsx-a11y/no-autofocus': 'off',
-    },
-  },
-  {
-    // The settings and xray pages write numeric InputNumber changes straight
-    // into state, so a null-collapsing handler (`Number(v) || N`, or the
-    // ternary `typeof v === 'number' ? v : N`) turns a cleared field into a
-    // stored N — the cleared-port bug, #6121. Handlers here go through
-    // onNumber() (src/utils/onNumber.ts) instead. Known limit: a handler
-    // extracted into a variable and passed as onChange={handler} is not
-    // matched; the inline shapes below are the ones that drift in practice.
-    files: ['src/pages/settings/**/*.tsx', 'src/pages/xray/**/*.tsx'],
-    rules: {
-      'no-restricted-syntax': ['error', {
-        selector: 'JSXElement[openingElement.name.name="InputNumber"] JSXAttribute[name.name="onChange"] LogicalExpression[operator="||"] > CallExpression[callee.name="Number"]',
-        message: 'A cleared InputNumber must not write a synthetic value; wrap the handler with onNumber() from @/utils/onNumber (see #6127).',
-      }, {
-        selector: 'JSXElement[openingElement.name.name="InputNumber"] JSXAttribute[name.name="onChange"] ConditionalExpression[test.left.operator="typeof"][alternate.type="Literal"]',
-        message: 'A cleared InputNumber must not write a synthetic value; wrap the handler with onNumber() from @/utils/onNumber (see #6127).',
-      }, {
-        selector: 'JSXElement[openingElement.name.name="InputNumber"] JSXAttribute[name.name="onChange"] LogicalExpression[operator="??"][right.type="Literal"]',
-        message: 'A cleared InputNumber must not write a synthetic value; wrap the handler with onNumber() from @/utils/onNumber (see #6127).',
-      }],
-    },
-  },
-  {
-    // The xray form modals (OutboundFormModal, BalancerFormModal,
-    // DnsServerModal, WarpModal, …) stage values behind Zod validation like
-    // the clients/inbounds modals do, and some of their fields carry a
-    // deliberate clear-means-zero semantic — the direct-write rule above
-    // does not apply to them.
-    files: ['src/pages/xray/**/*Modal.tsx'],
-    rules: {
-      'no-restricted-syntax': 'off',
-    },
-  },
-];

+ 0 - 26
frontend/eslint.deprecated.config.js

@@ -1,26 +0,0 @@
-import tseslint from 'typescript-eslint';
-import reactHooks from 'eslint-plugin-react-hooks';
-
-export default [
-  { ignores: ['node_modules/**', '../internal/web/dist/**', 'src/generated/**'] },
-  {
-    files: ['**/*.{ts,tsx}'],
-    plugins: {
-      '@typescript-eslint': tseslint.plugin,
-      'react-hooks': reactHooks,
-    },
-    languageOptions: {
-      parser: tseslint.parser,
-      parserOptions: {
-        projectService: true,
-        tsconfigRootDir: import.meta.dirname,
-      },
-    },
-    rules: {
-      '@typescript-eslint/no-deprecated': 'warn',
-    },
-    linterOptions: {
-      reportUnusedDisableDirectives: 'off',
-    },
-  },
-];

Rozdielové dáta súboru neboli zobrazené, pretože súbor je príliš veľký
+ 611 - 941
frontend/package-lock.json


+ 25 - 24
frontend/package.json

@@ -12,7 +12,11 @@
     "dev": "vite",
     "build": "npm run gen:api && vite build",
     "preview": "vite preview",
-    "lint": "eslint src",
+    "lint": "oxlint src tools",
+    "lint:fix": "oxlint --fix src tools",
+    "lint:deprecated": "oxlint --type-aware -A all -D typescript/no-deprecated src",
+    "format": "oxfmt src tools",
+    "format:check": "oxfmt --check src tools",
     "typecheck": "tsc --noEmit",
     "test": "vitest run",
     "test:watch": "vitest",
@@ -24,19 +28,22 @@
     "prepare": "cd .. && husky frontend/.husky || true"
   },
   "lint-staged": {
-    "src/**/*.{ts,tsx}": "eslint --fix"
+    "src/**/*.{ts,tsx}": [
+      "oxfmt",
+      "oxlint --fix"
+    ]
   },
   "dependencies": {
     "@ant-design/icons": "^6.3.2",
     "@codemirror/lang-json": "^6.0.2",
     "@codemirror/theme-one-dark": "^6.1.3",
-    "@hookform/resolvers": "^5.7.1",
+    "@hookform/resolvers": "^5.9.1",
     "@noble/hashes": "^2.3.0",
     "@tanstack/react-query": "^5.101.4",
     "@tanstack/react-query-devtools": "^5.101.4",
-    "antd": "^6.6.0",
+    "antd": "^6.6.1",
     "codemirror": "^6.0.2",
-    "dayjs": "^1.11.21",
+    "dayjs": "^1.11.23",
     "i18next": "^26.3.6",
     "otpauth": "^9.5.1",
     "persian-calendar-suite": "^1.5.6",
@@ -45,43 +52,37 @@
     "react-hook-form": "^7.85.0",
     "react-i18next": "^17.0.11",
     "react-router": "^8.3.0",
-    "swagger-ui-react": "^5.32.13",
+    "swagger-ui-react": "^5.32.14",
     "uplot": "^1.6.32",
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@eslint/js": "^10.0.1",
-    "@storybook/addon-a11y": "^10.5.7",
-    "@storybook/addon-docs": "^10.5.7",
-    "@storybook/addon-vitest": "^10.5.7",
-    "@storybook/react-vite": "^10.5.7",
+    "@storybook/addon-a11y": "^10.5.9",
+    "@storybook/addon-docs": "^10.5.9",
+    "@storybook/addon-vitest": "^10.5.9",
+    "@storybook/react-vite": "^10.5.9",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/react": "^16.3.2",
     "@types/react": "^19.2.18",
     "@types/react-dom": "^19.2.4",
     "@types/swagger-ui-react": "^5.18.0",
     "@vitejs/plugin-react": "^6.0.5",
-    "@vitest/browser-playwright": "4.1.10",
-    "@vitest/coverage-v8": "^4.1.10",
-    "eslint": "^10.8.1",
-    "eslint-plugin-jsx-a11y": "^6.10.2",
-    "eslint-plugin-react-hooks": "^7.1.1",
-    "globals": "^17.11.0",
+    "@vitest/browser-playwright": "4.1.11",
+    "@vitest/coverage-v8": "^4.1.11",
     "husky": "^9.1.7",
     "jsdom": "^30.0.1",
     "lint-staged": "^17.3.0",
     "msw": "^2.15.0",
+    "oxfmt": "0.64.0",
+    "oxlint": "1.79.0",
+    "oxlint-tsgolint": "^7.0.2001",
     "playwright": "^1.62.1",
-    "storybook": "^10.5.7",
-    "typescript": "6.0.3",
-    "typescript-eslint": "^8.67.0",
+    "storybook": "^10.5.9",
+    "typescript": "7.0.2",
     "vite": "8.2.1",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.11"
   },
   "overrides": {
-    "eslint-plugin-jsx-a11y": {
-      "eslint": "$eslint"
-    },
     "dompurify": "^3.4.11",
     "react-copy-to-clipboard": "^5.1.1",
     "react-inspector": "^9.0.0",

+ 3 - 1
frontend/src/api/http-init.ts

@@ -79,7 +79,9 @@ function encodeForm(data: unknown): string {
       return;
     }
     if (typeof value === 'object') {
-      Object.entries(value as Record<string, unknown>).forEach(([k, v]) => append(`${key}[${k}]`, v));
+      Object.entries(value as Record<string, unknown>).forEach(([k, v]) =>
+        append(`${key}[${k}]`, v),
+      );
       return;
     }
     parts.push(`${encodeURIComponent(key)}=${encodeURIComponent(String(value))}`);

+ 26 - 10
frontend/src/api/queries/useAllSettings.ts

@@ -4,7 +4,11 @@ import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
 import { HttpUtil, Msg } from '@/utils';
 import { parseMsg } from '@/utils/zodValidate';
 import { AllSetting } from '@/models/setting';
-import { AllSettingResponseSchema, AllSettingSchema, type AllSettingInput } from '@/schemas/setting';
+import {
+  AllSettingResponseSchema,
+  AllSettingSchema,
+  type AllSettingInput,
+} from '@/schemas/setting';
 import { keys } from '@/api/queryKeys';
 import { useServerDraft } from '@/hooks/useServerDraft';
 
@@ -39,22 +43,34 @@ export function useAllSettings() {
   );
   const allSetting = draft ?? server;
 
-  const updateSetting = useCallback((patch: Partial<AllSetting>) => {
-    setDraft((prev) => {
-      const next = new AllSetting(prev ?? server);
-      Object.assign(next, patch);
-      return next;
-    });
-  }, [server, setDraft]);
+  const updateSetting = useCallback(
+    (patch: Partial<AllSetting>) => {
+      setDraft((prev) => {
+        const next = new AllSetting(prev ?? server);
+        Object.assign(next, patch);
+        return next;
+      });
+    },
+    [server, setDraft],
+  );
 
   const saveMut = useMutation({
-    mutationFn: async ({ payload, saved }: { payload: SettingSavePayload; saved?: AllSetting }): Promise<SettingSaveResult> => {
+    mutationFn: async ({
+      payload,
+      saved,
+    }: {
+      payload: SettingSavePayload;
+      saved?: AllSetting;
+    }): Promise<SettingSaveResult> => {
       const next = { ...payload };
       const body = AllSettingSchema.partial().safeParse(next);
       if (!body.success) {
         console.warn('[zod] setting/update body failed validation', body.error.issues);
       }
-      const msg = await HttpUtil.post('/panel/api/setting/update', body.success ? { ...next, ...body.data } : next);
+      const msg = await HttpUtil.post(
+        '/panel/api/setting/update',
+        body.success ? { ...next, ...body.data } : next,
+      );
       return { msg, saved };
     },
     onSuccess: ({ msg, saved }) => {

+ 3 - 1
frontend/src/api/queries/useFactoryDefaults.ts

@@ -6,7 +6,9 @@ import { FactoryDefaultsSchema, type FactoryDefaults } from '@/schemas/setting';
 import { keys } from '@/api/queryKeys';
 
 async function fetchFactoryDefaults(): Promise<FactoryDefaults> {
-  const msg = await HttpUtil.post('/panel/api/setting/factoryDefaults', undefined, { silent: true });
+  const msg = await HttpUtil.post('/panel/api/setting/factoryDefaults', undefined, {
+    silent: true,
+  });
   if (!msg?.success) throw new Error(msg?.msg || 'Failed to fetch factory defaults');
   const validated = parseMsg(msg, FactoryDefaultsSchema, 'setting/factoryDefaults');
   const parsed = FactoryDefaultsSchema.safeParse(validated.obj);

+ 3 - 1
frontend/src/api/queries/useFail2banStatusQuery.ts

@@ -18,7 +18,9 @@ const FAIL_OPEN_STATUS: Fail2banStatus = {
 };
 
 async function fetchFail2banStatus(): Promise<Fail2banStatus> {
-  const msg = await HttpUtil.get<Fail2banStatus>('/panel/api/server/fail2banStatus', undefined, { silent: true });
+  const msg = await HttpUtil.get<Fail2banStatus>('/panel/api/server/fail2banStatus', undefined, {
+    silent: true,
+  });
   if (!msg?.success || !msg.obj) throw new Error(msg?.msg || 'Failed to fetch fail2ban status');
   return { ...FAIL_OPEN_STATUS, ...msg.obj };
 }

+ 11 - 2
frontend/src/api/queries/useGeodata.ts

@@ -2,7 +2,12 @@ import { keepPreviousData, useMutation, useQuery } from '@tanstack/react-query';
 import { z } from 'zod';
 
 import { keys } from '@/api/queryKeys';
-import { GeoCategoryPageSchema, GeoEntryPageSchema, GeoFileSchema, GeodataTokenIssueSchema } from '@/generated/zod';
+import {
+  GeoCategoryPageSchema,
+  GeoEntryPageSchema,
+  GeoFileSchema,
+  GeodataTokenIssueSchema,
+} from '@/generated/zod';
 import type { GeoCategoryPage, GeoEntryPage, GeoFile, GeodataTokenIssue } from '@/generated/types';
 import { HttpUtil } from '@/utils';
 import { parseMsg } from '@/utils/zodValidate';
@@ -28,7 +33,11 @@ async function fetchGeodataFiles(): Promise<GeoFile[]> {
 }
 
 async function fetchGeodataCategories(file: string, query: string): Promise<GeoCategoryPage> {
-  const msg = await HttpUtil.get('/panel/api/xray/geodata/categories', { file, q: query }, { silent: true });
+  const msg = await HttpUtil.get(
+    '/panel/api/xray/geodata/categories',
+    { file, q: query },
+    { silent: true },
+  );
   if (!msg?.success) throw new Error(msg?.msg || 'Failed to fetch geodata categories');
   const validated = parseMsg(msg, GeoCategoryPageSchema, 'xray/geodata/categories');
   return validated.obj ?? EMPTY_CATEGORY_PAGE;

+ 31 - 12
frontend/src/api/queries/useHostMutations.ts

@@ -11,50 +11,69 @@ export function useHostMutations() {
   const invalidate = () => queryClient.invalidateQueries({ queryKey: keys.hosts.root() });
 
   const bulkCreateMut = useMutation({
-    mutationFn: (payload: BulkAddHostValues) => HttpUtil.post('/panel/api/hosts/bulk/add', payload, JSON_HEADERS),
-    onSuccess: (msg) => { if (msg?.success) invalidate(); },
+    mutationFn: (payload: BulkAddHostValues) =>
+      HttpUtil.post('/panel/api/hosts/bulk/add', payload, JSON_HEADERS),
+    onSuccess: (msg) => {
+      if (msg?.success) invalidate();
+    },
   });
 
   const updateMut = useMutation({
     mutationFn: ({ groupId, payload }: { groupId: string; payload: BulkAddHostValues }) =>
       HttpUtil.post(`/panel/api/hosts/update/${groupId}`, payload, JSON_HEADERS),
-    onSuccess: (msg) => { if (msg?.success) invalidate(); },
+    onSuccess: (msg) => {
+      if (msg?.success) invalidate();
+    },
   });
 
   const removeMut = useMutation({
     mutationFn: (groupId: string) => HttpUtil.post(`/panel/api/hosts/del/${groupId}`),
-    onSuccess: (msg) => { if (msg?.success) invalidate(); },
+    onSuccess: (msg) => {
+      if (msg?.success) invalidate();
+    },
   });
 
   const setEnableMut = useMutation({
     mutationFn: ({ groupId, enable }: { groupId: string; enable: boolean }) =>
       HttpUtil.post(`/panel/api/hosts/setEnable/${groupId}`, { enable }),
-    onSuccess: (msg) => { if (msg?.success) invalidate(); },
+    onSuccess: (msg) => {
+      if (msg?.success) invalidate();
+    },
   });
 
   const reorderMut = useMutation({
-    mutationFn: (groupIds: string[]) => HttpUtil.post('/panel/api/hosts/reorder', { ids: groupIds }, JSON_HEADERS),
-    onSuccess: (msg) => { if (msg?.success) invalidate(); },
+    mutationFn: (groupIds: string[]) =>
+      HttpUtil.post('/panel/api/hosts/reorder', { ids: groupIds }, JSON_HEADERS),
+    onSuccess: (msg) => {
+      if (msg?.success) invalidate();
+    },
   });
 
   const bulkEnableMut = useMutation({
     mutationFn: ({ groupIds, enable }: { groupIds: string[]; enable: boolean }) =>
       HttpUtil.post('/panel/api/hosts/bulk/setEnable', { ids: groupIds, enable }, JSON_HEADERS),
-    onSuccess: (msg) => { if (msg?.success) invalidate(); },
+    onSuccess: (msg) => {
+      if (msg?.success) invalidate();
+    },
   });
 
   const bulkDelMut = useMutation({
-    mutationFn: (groupIds: string[]) => HttpUtil.post('/panel/api/hosts/bulk/del', { ids: groupIds }, JSON_HEADERS),
-    onSuccess: (msg) => { if (msg?.success) invalidate(); },
+    mutationFn: (groupIds: string[]) =>
+      HttpUtil.post('/panel/api/hosts/bulk/del', { ids: groupIds }, JSON_HEADERS),
+    onSuccess: (msg) => {
+      if (msg?.success) invalidate();
+    },
   });
 
   return {
     bulkCreate: (payload: BulkAddHostValues) => bulkCreateMut.mutateAsync(payload),
-    update: (groupId: string, payload: BulkAddHostValues) => updateMut.mutateAsync({ groupId, payload }),
+    update: (groupId: string, payload: BulkAddHostValues) =>
+      updateMut.mutateAsync({ groupId, payload }),
     remove: (groupId: string) => removeMut.mutateAsync(groupId),
     setEnable: (groupId: string, enable: boolean) => setEnableMut.mutateAsync({ groupId, enable }),
     reorder: (groupIds: string[]) => reorderMut.mutateAsync(groupIds),
-    bulkSetEnable: (groupIds: string[], enable: boolean) => bulkEnableMut.mutateAsync({ groupIds, enable }),
+    bulkSetEnable: (groupIds: string[], enable: boolean) =>
+      bulkEnableMut.mutateAsync({ groupIds, enable }),
     bulkDel: (groupIds: string[]) => bulkDelMut.mutateAsync(groupIds),
   };
 }

+ 29 - 14
frontend/src/api/queries/useNodeMutations.ts

@@ -30,27 +30,33 @@ export function useNodeMutations() {
   };
 
   const createMut = useMutation({
-    mutationFn: (payload: Partial<NodeRecord>) =>
-      HttpUtil.post('/panel/api/nodes/add', payload),
-    onSuccess: (msg) => { if (msg?.success) invalidate(); },
+    mutationFn: (payload: Partial<NodeRecord>) => HttpUtil.post('/panel/api/nodes/add', payload),
+    onSuccess: (msg) => {
+      if (msg?.success) invalidate();
+    },
   });
 
   const updateMut = useMutation({
     mutationFn: ({ id, payload }: { id: number; payload: Partial<NodeRecord> }) =>
       HttpUtil.post(`/panel/api/nodes/update/${id}`, payload),
-    onSuccess: (msg) => { if (msg?.success) invalidate(); },
+    onSuccess: (msg) => {
+      if (msg?.success) invalidate();
+    },
   });
 
   const removeMut = useMutation({
-    mutationFn: (id: number) =>
-      HttpUtil.post(`/panel/api/nodes/del/${id}`),
-    onSuccess: (msg) => { if (msg?.success) invalidate(); },
+    mutationFn: (id: number) => HttpUtil.post(`/panel/api/nodes/del/${id}`),
+    onSuccess: (msg) => {
+      if (msg?.success) invalidate();
+    },
   });
 
   const setEnableMut = useMutation({
     mutationFn: ({ id, enable }: { id: number; enable: boolean }) =>
       HttpUtil.post(`/panel/api/nodes/setEnable/${id}`, { enable }),
-    onSuccess: (msg) => { if (msg?.success) invalidate(); },
+    onSuccess: (msg) => {
+      if (msg?.success) invalidate();
+    },
   });
 
   const probeMut = useMutation({
@@ -58,15 +64,23 @@ export function useNodeMutations() {
       const raw = await HttpUtil.post(`/panel/api/nodes/probe/${id}`);
       return parseMsg(raw, ProbeResultSchema, 'nodes/probe');
     },
-    onSuccess: (msg) => { if (msg?.success) invalidate(); },
+    onSuccess: (msg) => {
+      if (msg?.success) invalidate();
+    },
   });
 
   const updatePanelsMut = useMutation({
     mutationFn: ({ ids, dev }: { ids: number[]; dev: boolean }) =>
-      HttpUtil.post<NodeUpdateResult[]>('/panel/api/nodes/updatePanel', { ids, dev }, {
-        headers: { 'Content-Type': 'application/json' },
-      }),
-    onSuccess: (msg) => { if (msg?.success) invalidate(); },
+      HttpUtil.post<NodeUpdateResult[]>(
+        '/panel/api/nodes/updatePanel',
+        { ids, dev },
+        {
+          headers: { 'Content-Type': 'application/json' },
+        },
+      ),
+    onSuccess: (msg) => {
+      if (msg?.success) invalidate();
+    },
   });
 
   return {
@@ -75,7 +89,8 @@ export function useNodeMutations() {
     remove: (id: number) => removeMut.mutateAsync(id),
     setEnable: (id: number, enable: boolean) => setEnableMut.mutateAsync({ id, enable }),
     probe: (id: number) => probeMut.mutateAsync(id),
-    updatePanels: (ids: number[], dev: boolean): Promise<Msg<NodeUpdateResult[]>> => updatePanelsMut.mutateAsync({ ids, dev }),
+    updatePanels: (ids: number[], dev: boolean): Promise<Msg<NodeUpdateResult[]>> =>
+      updatePanelsMut.mutateAsync({ ids, dev }),
     testConnection: async (payload: Partial<NodeRecord>): Promise<Msg<ProbeResult>> => {
       const raw = await HttpUtil.post('/panel/api/nodes/test', payload);
       return parseMsg(raw, ProbeResultSchema, 'nodes/test');

+ 6 - 2
frontend/src/api/queries/useOutboundTags.ts

@@ -26,7 +26,9 @@ export function useOutboundTags(opts?: { excludeBlackhole?: boolean }) {
       }
       // Balancers are valid routing targets too — injectMtprotoEgress emits a
       // balancerTag rule when the chosen tag names a balancer.
-      const balancers = (data?.xraySetting?.routing as { balancers?: Array<{ tag?: string }> } | undefined)?.balancers;
+      const balancers = (
+        data?.xraySetting?.routing as { balancers?: Array<{ tag?: string }> } | undefined
+      )?.balancers;
       for (const b of balancers ?? []) {
         if (b?.tag) tags.add(b.tag);
       }
@@ -61,7 +63,9 @@ export function useOutboundTagGroups(opts?: { excludeBlackhole?: boolean }) {
         if (t) outbounds.add(t);
       }
       const balancers: string[] = [];
-      const bal = (data?.xraySetting?.routing as { balancers?: Array<{ tag?: string }> } | undefined)?.balancers;
+      const bal = (
+        data?.xraySetting?.routing as { balancers?: Array<{ tag?: string }> } | undefined
+      )?.balancers;
       for (const b of bal ?? []) {
         if (b?.tag && !outbounds.has(b.tag)) balancers.push(b.tag);
       }

+ 3 - 1
frontend/src/api/queries/useStatusQuery.ts

@@ -26,7 +26,9 @@ export function useStatusQuery() {
   });
 
   const status = useMemo(() => query.data ?? new Status(), [query.data]);
-  const refresh = async () => { await query.refetch(); };
+  const refresh = async () => {
+    await query.refetch();
+  };
 
   return {
     status,

+ 2 - 1
frontend/src/api/queryKeys.ts

@@ -41,7 +41,8 @@ export const keys = {
     geodata: {
       root: () => ['xray', 'geodata'] as const,
       files: () => ['xray', 'geodata', 'files'] as const,
-      categories: (file: string, query: string) => ['xray', 'geodata', 'categories', file, query] as const,
+      categories: (file: string, query: string) =>
+        ['xray', 'geodata', 'categories', file, query] as const,
       entries: (file: string, code: string, query: string, offset: number, limit: number) =>
         ['xray', 'geodata', 'entries', file, code, query, offset, limit] as const,
     },

+ 15 - 4
frontend/src/api/websocket.ts

@@ -35,7 +35,10 @@ export class WebSocketClient {
   }
 
   connect(): void {
-    if (this.ws && (this.ws.readyState === WebSocket.OPEN || this.ws.readyState === WebSocket.CONNECTING)) {
+    if (
+      this.ws &&
+      (this.ws.readyState === WebSocket.OPEN || this.ws.readyState === WebSocket.CONNECTING)
+    ) {
       return;
     }
     this.shouldReconnect = true;
@@ -48,7 +51,9 @@ export class WebSocketClient {
     this.#cancelReconnect();
     this.reconnectAttempts = 0;
     if (this.ws) {
-      try { this.ws.close(1000, 'client disconnect'); } catch {}
+      try {
+        this.ws.close(1000, 'client disconnect');
+      } catch {}
       this.ws = null;
     }
     this.isConnected = false;
@@ -130,7 +135,9 @@ export class WebSocketClient {
       const byteLen = new Blob([data]).size;
       if (byteLen > WebSocketClient.#MAX_PAYLOAD_BYTES) {
         console.error(`WebSocket: payload too large (${byteLen} bytes), closing`);
-        try { this.ws?.close(1009, 'message too big'); } catch {}
+        try {
+          this.ws?.close(1009, 'message too big');
+        } catch {}
         return;
       }
     }
@@ -141,7 +148,11 @@ export class WebSocketClient {
       console.error('WebSocket: invalid JSON message', err);
       return;
     }
-    if (!message || typeof message !== 'object' || typeof (message as { type?: unknown }).type !== 'string') {
+    if (
+      !message ||
+      typeof message !== 'object' ||
+      typeof (message as { type?: unknown }).type !== 'string'
+    ) {
       console.error('WebSocket: malformed message envelope');
       return;
     }

+ 5 - 2
frontend/src/components/clients/ClientCardComment.tsx

@@ -3,7 +3,10 @@ type ClientCardCommentProps = {
   className?: string;
 };
 
-export default function ClientCardComment({ comment, className = 'client-card-comment' }: ClientCardCommentProps) {
+export default function ClientCardComment({
+  comment,
+  className = 'client-card-comment',
+}: ClientCardCommentProps) {
   if (!comment) return null;
 
   return (
@@ -11,4 +14,4 @@ export default function ClientCardComment({ comment, className = 'client-card-co
       {comment}
     </span>
   );
-}
+}

+ 1 - 2
frontend/src/components/clients/ClientSpeedTag.tsx

@@ -23,8 +23,7 @@ export function ClientSpeedTag({ speed, tableCell = false }: ClientSpeedTagProps
       style={tableCell ? SPEED_TAG_STYLE : undefined}
     >
       ↑ {SizeFormatter.speedFormat(speed.up)}
-      {' / '}
-      ↓ {SizeFormatter.speedFormat(speed.down)}
+      {' / '}↓ {SizeFormatter.speedFormat(speed.down)}
     </Tag>
   );
 }

+ 4 - 1
frontend/src/components/clients/ClientTrafficCell.stories.tsx

@@ -31,7 +31,10 @@ const meta = {
     down: { description: 'Downloaded bytes counted against the client.' },
     total: { description: 'Traffic quota in bytes; 0 or less renders as unlimited.' },
     enabled: { description: 'Grays the bar out when the client is disabled.' },
-    trafficDiff: { description: 'Headroom in bytes below the quota at which the bar shifts from green to orange.' },
+    trafficDiff: {
+      description:
+        'Headroom in bytes below the quota at which the bar shifts from green to orange.',
+    },
     compact: { description: 'Smaller bar and tighter layout for dense table rows.' },
   },
 } satisfies Meta<typeof ClientTrafficCell>;

+ 8 - 2
frontend/src/components/clients/ClientTrafficCell.tsx

@@ -60,7 +60,9 @@ const ClientTrafficCell = memo(function ClientTrafficCell({
     'client-traffic-cell',
     compact ? 'is-compact' : '',
     display.isUnlimited ? 'is-unlimited' : '',
-  ].filter(Boolean).join(' ');
+  ]
+    .filter(Boolean)
+    .join(' ');
 
   return (
     <Popover content={popover} trigger={['hover', 'click']} placement="top">
@@ -77,7 +79,11 @@ const ClientTrafficCell = memo(function ClientTrafficCell({
         />
         <span className="client-traffic-cell-limit">
           {display.isUnlimited ? (
-            <span className="client-traffic-cell-infinity" role="img" aria-label={t('subscription.unlimited')}>
+            <span
+              className="client-traffic-cell-infinity"
+              role="img"
+              aria-label={t('subscription.unlimited')}
+            >
               <InfinityIcon />
             </span>
           ) : (

+ 17 - 5
frontend/src/components/clients/ConfigBlock.stories.tsx

@@ -17,8 +17,13 @@ const meta = {
     },
   },
   argTypes: {
-    label: { description: 'Protocol/type badge shown on the panel header (e.g. `vless`, `trojan`).' },
-    text: { description: 'The config or share-link text to display, copy, download, and encode as a QR code.' },
+    label: {
+      description: 'Protocol/type badge shown on the panel header (e.g. `vless`, `trojan`).',
+    },
+    text: {
+      description:
+        'The config or share-link text to display, copy, download, and encode as a QR code.',
+    },
     fileName: { description: 'File name used when downloading the text.' },
     qrRemark: { description: 'Optional remark embedded in the QR panel; falls back to `label`.' },
     showQr: { description: 'Whether to show the QR-code action button.' },
@@ -31,8 +36,9 @@ export default meta;
 
 type Story = StoryObj<typeof meta>;
 
-const sampleLink = 'vless://[email protected]:443'
-  + '?type=ws&security=tls&path=%2Fpath#example-node';
+const sampleLink =
+  'vless://[email protected]:443' +
+  '?type=ws&security=tls&path=%2Fpath#example-node';
 
 export const Collapsed: Story = {
   args: { label: 'vless', text: sampleLink, fileName: 'client-config.txt' },
@@ -58,5 +64,11 @@ export const Expanded: Story = {
 };
 
 export const WithoutQr: Story = {
-  args: { label: 'trojan', text: sampleLink, fileName: 'client-config.txt', showQr: false, tagColor: 'geekblue' },
+  args: {
+    label: 'trojan',
+    text: sampleLink,
+    fileName: 'client-config.txt',
+    showQr: false,
+    tagColor: 'geekblue',
+  },
 };

+ 12 - 6
frontend/src/components/clients/ConfigBlock.tsx

@@ -70,12 +70,18 @@ export default function ConfigBlock({
         className="config-block"
         collapsible="header"
         defaultActiveKey={defaultOpen ? ['cfg'] : []}
-        items={[{
-          key: 'cfg',
-          label: <Tag color={tagColor} style={{ margin: 0, fontWeight: 600, letterSpacing: '0.3px' }}>{label}</Tag>,
-          extra: actions,
-          children: <code className="config-block-text">{text}</code>,
-        }]}
+        items={[
+          {
+            key: 'cfg',
+            label: (
+              <Tag color={tagColor} style={{ margin: 0, fontWeight: 600, letterSpacing: '0.3px' }}>
+                {label}
+              </Tag>
+            ),
+            extra: actions,
+            children: <code className="config-block-text">{text}</code>,
+          },
+        ]}
       />
     </>
   );

+ 3 - 1
frontend/src/components/feedback/PromptModal.stories.tsx

@@ -39,7 +39,9 @@ function InputDemo() {
   const [value, setValue] = useState('');
   return (
     <>
-      <Button type="primary" onClick={() => setOpen(true)}>Rename client</Button>
+      <Button type="primary" onClick={() => setOpen(true)}>
+        Rename client
+      </Button>
       <div style={{ marginTop: 12 }}>Last confirmed: {value || '—'}</div>
       <PromptModal
         open={open}

+ 19 - 9
frontend/src/components/feedback/PromptModal.tsx

@@ -33,15 +33,21 @@ export default function PromptModal({
   const textareaRef = useRef<HTMLTextAreaElement | null>(null);
   const inputRef = useRef<InputRef | null>(null);
 
+  const [openedWith, setOpenedWith] = useState<string | null>(null);
+  const openKey = open ? `${type}\u0000${initialValue}` : null;
+  if (openKey !== openedWith) {
+    setOpenedWith(openKey);
+    if (open) setValue(initialValue);
+  }
+
   useEffect(() => {
-    if (open) {
-      setValue(initialValue);
-      setTimeout(() => {
-        if (type === 'textarea') textareaRef.current?.focus();
-        else inputRef.current?.focus();
-      }, 50);
-    }
-  }, [open, initialValue, type]);
+    if (!open) return;
+    const id = setTimeout(() => {
+      if (type === 'textarea') textareaRef.current?.focus();
+      else inputRef.current?.focus();
+    }, 50);
+    return () => clearTimeout(id);
+  }, [open, type]);
 
   function onKeydown(e: React.KeyboardEvent<HTMLTextAreaElement | HTMLInputElement>) {
     if (type !== 'textarea' && e.key === 'Enter') {
@@ -71,7 +77,11 @@ export default function PromptModal({
         <JsonEditor value={value} onChange={setValue} minHeight="240px" maxHeight="60vh" />
       ) : type === 'textarea' ? (
         <Input.TextArea
-          ref={(el) => { textareaRef.current = (el as unknown as { resizableTextArea?: { textArea: HTMLTextAreaElement } })?.resizableTextArea?.textArea ?? null; }}
+          ref={(el) => {
+            textareaRef.current =
+              (el as unknown as { resizableTextArea?: { textArea: HTMLTextAreaElement } })
+                ?.resizableTextArea?.textArea ?? null;
+          }}
           aria-label={title}
           value={value}
           onChange={(e) => setValue(e.target.value)}

+ 7 - 2
frontend/src/components/feedback/TextModal.stories.tsx

@@ -21,8 +21,13 @@ const meta = {
     open: { description: 'Whether the modal is visible.' },
     title: { description: 'Modal title text.' },
     content: { description: 'Text shown when no `tabs` are provided.' },
-    fileName: { description: 'When set, adds a download button that saves the active content under this name.' },
-    json: { description: 'Render the content in a read-only JSON editor with syntax highlighting.' },
+    fileName: {
+      description:
+        'When set, adds a download button that saves the active content under this name.',
+    },
+    json: {
+      description: 'Render the content in a read-only JSON editor with syntax highlighting.',
+    },
     tabs: { description: 'Optional list of `{ key, label, content }` documents shown as tabs.' },
     onClose: { description: 'Called when the modal is dismissed.' },
   },

+ 53 - 38
frontend/src/components/feedback/TextModal.tsx

@@ -1,4 +1,4 @@
-import { useEffect, useState } from 'react';
+import { useCallback, useState } from 'react';
 import { Button, Input, Modal, Tabs, message } from 'antd';
 import { CopyOutlined, DownloadOutlined } from '@ant-design/icons';
 import { useTranslation } from 'react-i18next';
@@ -22,14 +22,25 @@ interface TextModalProps {
   tabs?: TextModalTab[];
 }
 
-export default function TextModal({ open, onClose, title, content, fileName = '', json = false, tabs }: TextModalProps) {
+export default function TextModal({
+  open,
+  onClose,
+  title,
+  content,
+  fileName = '',
+  json = false,
+  tabs,
+}: TextModalProps) {
   const { t } = useTranslation();
   const [messageApi, messageContextHolder] = message.useMessage();
   const [activeKey, setActiveKey] = useState('');
 
-  useEffect(() => {
-    if (open && tabs && tabs.length > 0) setActiveKey(tabs[0].key);
-  }, [open, tabs]);
+  // Reset on the way out so the next open starts on the first tab; activeTab
+  // falls back to tabs[0] whenever activeKey no longer matches.
+  const close = useCallback(() => {
+    setActiveKey('');
+    onClose();
+  }, [onClose]);
 
   const activeTab = tabs?.find((tab) => tab.key === activeKey) ?? tabs?.[0];
   const activeContent = activeTab ? activeTab.content : content;
@@ -38,7 +49,7 @@ export default function TextModal({ open, onClose, title, content, fileName = ''
     const ok = await ClipboardManager.copyText(activeContent || '');
     if (ok) {
       messageApi.success(t('copied'));
-      onClose();
+      close();
     }
   }
 
@@ -53,39 +64,43 @@ export default function TextModal({ open, onClose, title, content, fileName = ''
       <Modal
         open={open}
         title={title}
-        onCancel={onClose}
+        onCancel={close}
         destroyOnHidden
-      footer={(
-        <>
-          {fileName && (
-            <Button icon={<DownloadOutlined />} onClick={download}>{fileName}</Button>
-          )}
-          <Button type="primary" icon={<CopyOutlined />} onClick={copy}>{t('copy')}</Button>
-        </>
-      )}
-    >
-      {tabs && tabs.length > 0 && (
-        <Tabs
-          activeKey={activeTab?.key}
-          onChange={setActiveKey}
-          items={tabs.map((tab) => ({ key: tab.key, label: tab.label }))}
-        />
-      )}
-      {json ? (
-        <JsonEditor value={activeContent} readOnly minHeight="240px" maxHeight="60vh" />
-      ) : (
-        <Input.TextArea
-          aria-label={title}
-          value={activeContent}
-          readOnly
-          autoSize={{ minRows: 10, maxRows: 20 }}
-          style={{
-            fontFamily: 'ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, monospace',
-            fontSize: 12,
-            overflowY: 'auto',
-          }}
-        />
-      )}
+        footer={
+          <>
+            {fileName && (
+              <Button icon={<DownloadOutlined />} onClick={download}>
+                {fileName}
+              </Button>
+            )}
+            <Button type="primary" icon={<CopyOutlined />} onClick={copy}>
+              {t('copy')}
+            </Button>
+          </>
+        }
+      >
+        {tabs && tabs.length > 0 && (
+          <Tabs
+            activeKey={activeTab?.key}
+            onChange={setActiveKey}
+            items={tabs.map((tab) => ({ key: tab.key, label: tab.label }))}
+          />
+        )}
+        {json ? (
+          <JsonEditor value={activeContent} readOnly minHeight="240px" maxHeight="60vh" />
+        ) : (
+          <Input.TextArea
+            aria-label={title}
+            value={activeContent}
+            readOnly
+            autoSize={{ minRows: 10, maxRows: 20 }}
+            style={{
+              fontFamily: 'ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, monospace',
+              fontSize: 12,
+              overflowY: 'auto',
+            }}
+          />
+        )}
       </Modal>
     </>
   );

+ 2 - 2
frontend/src/components/form/DateTimePicker.css

@@ -27,7 +27,7 @@
 
 .jdp-dark input::placeholder,
 .jdp-ultra input::placeholder {
-  color: rgba(255, 255, 255, 0.30) !important;
+  color: rgba(255, 255, 255, 0.3) !important;
 }
 
 .jdp-disabled {
@@ -62,7 +62,7 @@
 }
 
 .jdp-dark .jdp-clear {
-  color: rgba(255, 255, 255, 0.30);
+  color: rgba(255, 255, 255, 0.3);
 }
 
 .jdp-dark .jdp-clear:hover,

+ 3 - 1
frontend/src/components/form/DateTimePicker.stories.tsx

@@ -17,7 +17,9 @@ function ClientExpiryDemo() {
     <div style={{ display: 'flex', flexDirection: 'column', gap: 8 }}>
       <DateTimePicker value={value} onChange={setValue} placeholder="Expiry date" />
       <Typography.Text type="secondary">
-        {value ? `user1@node-de expiryTime: ${value.valueOf()}` : 'user1@node-de expiryTime: 0 (never expires)'}
+        {value
+          ? `user1@node-de expiryTime: ${value.valueOf()}`
+          : 'user1@node-de expiryTime: 0 (never expires)'}
       </Typography.Text>
     </div>
   );

+ 4 - 1
frontend/src/components/form/DateTimePicker.tsx

@@ -90,7 +90,10 @@ export default function DateTimePicker({
 
   if (datepicker === 'jalalian') {
     return (
-      <div ref={jalaliRef} className={`jdp-wrap${isDark ? ' jdp-dark' : ''}${isUltra ? ' jdp-ultra' : ''}${disabled ? ' jdp-disabled' : ''}${value ? '' : ' jdp-empty'}`}>
+      <div
+        ref={jalaliRef}
+        className={`jdp-wrap${isDark ? ' jdp-dark' : ''}${isUltra ? ' jdp-ultra' : ''}${disabled ? ' jdp-disabled' : ''}${value ? '' : ' jdp-empty'}`}
+      >
         <PersianDateTimePicker
           key={clearNonce}
           value={value ? value.valueOf() : null}

+ 19 - 4
frontend/src/components/form/HeaderMapEditor.stories.tsx

@@ -17,9 +17,17 @@ const meta = {
     },
   },
   argTypes: {
-    mode: { description: 'Wire shape: `v1` = string per name, `v2` = string[] per name (repeatable headers).' },
-    value: { description: 'Header map in the wire shape matching `mode`; converted to editable rows internally.' },
-    onChange: { description: 'Called with the rebuilt wire-shape map after every row edit, add, or remove.' },
+    mode: {
+      description:
+        'Wire shape: `v1` = string per name, `v2` = string[] per name (repeatable headers).',
+    },
+    value: {
+      description:
+        'Header map in the wire shape matching `mode`; converted to editable rows internally.',
+    },
+    onChange: {
+      description: 'Called with the rebuilt wire-shape map after every row edit, add, or remove.',
+    },
   },
 } satisfies Meta<typeof HeaderMapEditor>;
 
@@ -63,7 +71,14 @@ function WireShapeDemo() {
   return (
     <div style={{ maxWidth: 560 }}>
       <HeaderMapEditor mode="v2" value={value} onChange={setValue} />
-      <pre style={{ marginTop: 16, padding: 12, borderRadius: 8, background: 'rgba(128, 128, 128, 0.12)' }}>
+      <pre
+        style={{
+          marginTop: 16,
+          padding: 12,
+          borderRadius: 8,
+          background: 'rgba(128, 128, 128, 0.12)',
+        }}
+      >
         {JSON.stringify(value ?? {}, null, 2)}
       </pre>
     </div>

+ 10 - 6
frontend/src/components/form/HeaderMapEditor.tsx

@@ -24,10 +24,7 @@ import { InputAddon } from '@/components/ui';
 
 export type HeaderMapMode = 'v1' | 'v2';
 
-export type HeaderMapValue =
-  | Record<string, string>
-  | Record<string, string[]>
-  | undefined;
+export type HeaderMapValue = Record<string, string> | Record<string, string[]> | undefined;
 
 interface HeaderRow {
   name: string;
@@ -55,7 +52,10 @@ function mapToRows(value: HeaderMapValue): HeaderRow[] {
   return out;
 }
 
-function rowsToMap(rows: HeaderRow[], mode: HeaderMapMode): Record<string, string> | Record<string, string[]> {
+function rowsToMap(
+  rows: HeaderRow[],
+  mode: HeaderMapMode,
+): Record<string, string> | Record<string, string[]> {
   if (mode === 'v1') {
     const map: Record<string, string> = {};
     for (const r of rows) {
@@ -132,7 +132,11 @@ export default function HeaderMapEditor({ mode, value, onChange }: HeaderMapEdit
             placeholder="Value"
             onChange={(e) => setRow(idx, { value: e.target.value })}
           />
-          <Button aria-label={t('remove')} icon={<MinusOutlined />} onClick={() => removeRow(idx)} />
+          <Button
+            aria-label={t('remove')}
+            icon={<MinusOutlined />}
+            onClick={() => removeRow(idx)}
+          />
         </Space.Compact>
       ))}
       <Button size="small" type="primary" icon={<PlusOutlined />} onClick={addRow}>

+ 3 - 2
frontend/src/components/form/JsonEditor.tsx

@@ -45,8 +45,9 @@ function buildDarkTheme({ bg, panelBg, activeBg, border, selection }: DarkPalett
       },
       '.cm-activeLine': { backgroundColor: activeBg },
       '.cm-activeLineGutter': { backgroundColor: activeBg, color: '#dcdcdc' },
-      '&.cm-focused .cm-selectionBackground, .cm-selectionBackground, .cm-content ::selection':
-        { backgroundColor: selection },
+      '&.cm-focused .cm-selectionBackground, .cm-selectionBackground, .cm-content ::selection': {
+        backgroundColor: selection,
+      },
       '.cm-panels': { backgroundColor: panelBg, color: '#dcdcdc' },
       '.cm-panels.cm-panels-top': { borderBottom: `1px solid ${border}` },
       '.cm-panels.cm-panels-bottom': { borderTop: `1px solid ${border}` },

+ 12 - 2
frontend/src/components/form/RemarkTemplateField.stories.tsx

@@ -17,7 +17,10 @@ const meta = {
     },
   },
   argTypes: {
-    value: { description: 'Current template string; any {{VAR}} token enables the live preview below the input.' },
+    value: {
+      description:
+        'Current template string; any {{VAR}} token enables the live preview below the input.',
+    },
     onChange: { description: 'Called with the updated template on typing or token insertion.' },
     maxLength: { description: 'Maximum template length; picker insertions are clamped to it.' },
     placeholder: { description: 'Placeholder shown while the template is empty.' },
@@ -30,7 +33,14 @@ type Story = StoryObj<typeof meta>;
 
 function InteractiveDemo() {
   const [value, setValue] = useState('{{STATUS_EMOJI}} {{INBOUND}}-{{EMAIL}} | {{TRAFFIC_LEFT}}');
-  return <RemarkTemplateField value={value} onChange={setValue} maxLength={256} placeholder="{{INBOUND}}-{{EMAIL}}" />;
+  return (
+    <RemarkTemplateField
+      value={value}
+      onChange={setValue}
+      maxLength={256}
+      placeholder="{{INBOUND}}-{{EMAIL}}"
+    />
+  );
 }
 
 export const Empty: Story = {

+ 25 - 4
frontend/src/components/form/RemarkTemplateField.tsx

@@ -5,7 +5,12 @@ import type { TextAreaRef } from 'antd/es/input/TextArea';
 import { CodeOutlined } from '@ant-design/icons';
 import { useTranslation } from 'react-i18next';
 
-import { hasRemarkTokens, previewRemark, SUBSCRIPTION_METADATA_VARIABLES, wrapToken } from '@/lib/remark/remarkVariables';
+import {
+  hasRemarkTokens,
+  previewRemark,
+  SUBSCRIPTION_METADATA_VARIABLES,
+  wrapToken,
+} from '@/lib/remark/remarkVariables';
 import RemarkVarPicker from './RemarkVarPicker';
 
 interface RemarkTemplateFieldProps {
@@ -24,7 +29,15 @@ interface RemarkTemplateFieldProps {
  * (insert-at-caret) and a live, sample-based preview of the expanded result.
  * Used for subscription text fields that support Remark Template variables.
  */
-export default function RemarkTemplateField({ value = '', onChange, maxLength, placeholder, multiline = false, rows, metadataOnly = false }: RemarkTemplateFieldProps) {
+export default function RemarkTemplateField({
+  value = '',
+  onChange,
+  maxLength,
+  placeholder,
+  multiline = false,
+  rows,
+  metadataOnly = false,
+}: RemarkTemplateFieldProps) {
   const { t } = useTranslation();
   const inputRef = useRef<InputRef>(null);
   const textAreaRef = useRef<TextAreaRef>(null);
@@ -60,7 +73,13 @@ export default function RemarkTemplateField({ value = '', onChange, maxLength, p
       title={t('pages.hosts.remarkVars.title')}
     >
       <Tooltip title={t('pages.hosts.remarkVars.title')}>
-        <Button type="text" size="small" icon={<CodeOutlined />} aria-label={t('pages.hosts.remarkVars.title')} style={{ marginInlineEnd: -7 }} />
+        <Button
+          type="text"
+          size="small"
+          icon={<CodeOutlined />}
+          aria-label={t('pages.hosts.remarkVars.title')}
+          style={{ marginInlineEnd: -7 }}
+        />
       </Tooltip>
     </Popover>
   );
@@ -92,7 +111,9 @@ export default function RemarkTemplateField({ value = '', onChange, maxLength, p
       {hasRemarkTokens(value) && (
         <div style={{ fontSize: 12, marginTop: 4, opacity: 0.7 }}>
           {t('pages.hosts.remarkVars.preview')}:{' '}
-          <span style={{ fontFamily: 'monospace' }}>{previewRemark(value, variables, metadataOnly) || '—'}</span>
+          <span style={{ fontFamily: 'monospace' }}>
+            {previewRemark(value, variables, metadataOnly) || '—'}
+          </span>
         </div>
       )}
     </div>

+ 7 - 2
frontend/src/components/form/RemarkVarPicker.stories.tsx

@@ -20,7 +20,10 @@ const meta = {
     },
   },
   argTypes: {
-    onPick: { description: 'Called with the bare token (e.g. "EMAIL") when a chip is clicked or activated via keyboard.' },
+    onPick: {
+      description:
+        'Called with the bare token (e.g. "EMAIL") when a chip is clicked or activated via keyboard.',
+    },
   },
 } satisfies Meta<typeof RemarkVarPicker>;
 
@@ -29,7 +32,9 @@ export default meta;
 type Story = StoryObj<typeof meta>;
 
 function TemplateBuilderDemo() {
-  const [template, setTemplate] = useState('{{INBOUND}}-{{EMAIL}} {{STATUS_EMOJI}} {{TRAFFIC_LEFT}} left');
+  const [template, setTemplate] = useState(
+    '{{INBOUND}}-{{EMAIL}} {{STATUS_EMOJI}} {{TRAFFIC_LEFT}} left',
+  );
   return (
     <div style={{ maxWidth: 520 }}>
       <Input

+ 37 - 22
frontend/src/components/form/RemarkVarPicker.tsx

@@ -15,35 +15,50 @@ interface RemarkVarPickerProps {
  * RemarkVarPicker is the grouped, tooltipped chip list of {{VAR}} tokens used by
  * the global remark-template field.
  */
-export default function RemarkVarPicker({ onPick, variables = REMARK_VARIABLES }: RemarkVarPickerProps) {
+export default function RemarkVarPicker({
+  onPick,
+  variables = REMARK_VARIABLES,
+}: RemarkVarPickerProps) {
   const { t } = useTranslation();
   return (
     <div style={{ maxWidth: 460, maxHeight: 'min(70vh, 640px)', overflowY: 'auto' }}>
       <Typography.Paragraph type="secondary" style={{ fontSize: 12, marginBottom: 8 }}>
         {t('pages.hosts.remarkVars.intro')}
       </Typography.Paragraph>
-      {REMARK_VAR_GROUPS.filter((group) => variables.some((v) => v.group === group)).map((group) => (
-        <div key={group} style={{ marginBottom: 8 }}>
-          <div style={{ fontSize: 11, fontWeight: 600, textTransform: 'uppercase', opacity: 0.6, marginBottom: 4 }}>
-            {t(`pages.hosts.remarkVars.groups.${group}`)}
+      {REMARK_VAR_GROUPS.filter((group) => variables.some((v) => v.group === group)).map(
+        (group) => (
+          <div key={group} style={{ marginBottom: 8 }}>
+            <div
+              style={{
+                fontSize: 11,
+                fontWeight: 600,
+                textTransform: 'uppercase',
+                opacity: 0.6,
+                marginBottom: 4,
+              }}
+            >
+              {t(`pages.hosts.remarkVars.groups.${group}`)}
+            </div>
+            <div style={{ display: 'flex', flexWrap: 'wrap', gap: 4 }}>
+              {variables
+                .filter((v) => v.group === group)
+                .map((v) => (
+                  <Tooltip key={v.token} title={t(`pages.hosts.remarkVars.desc${v.token}`)}>
+                    <Tag
+                      role="button"
+                      tabIndex={0}
+                      onClick={() => onPick(v.token)}
+                      onKeyDown={activateOnKey(() => onPick(v.token))}
+                      style={{ cursor: 'pointer', margin: 0, fontFamily: 'monospace' }}
+                    >
+                      {wrapToken(v.token)}
+                    </Tag>
+                  </Tooltip>
+                ))}
+            </div>
           </div>
-          <div style={{ display: 'flex', flexWrap: 'wrap', gap: 4 }}>
-            {variables.filter((v) => v.group === group).map((v) => (
-              <Tooltip key={v.token} title={t(`pages.hosts.remarkVars.desc${v.token}`)}>
-                <Tag
-                  role="button"
-                  tabIndex={0}
-                  onClick={() => onPick(v.token)}
-                  onKeyDown={activateOnKey(() => onPick(v.token))}
-                  style={{ cursor: 'pointer', margin: 0, fontFamily: 'monospace' }}
-                >
-                  {wrapToken(v.token)}
-                </Tag>
-              </Tooltip>
-            ))}
-          </div>
-        </div>
-      ))}
+        ),
+      )}
     </div>
   );
 }

+ 16 - 4
frontend/src/components/form/SelectAllClearButtons.stories.tsx

@@ -33,11 +33,23 @@ const meta = {
     },
   },
   argTypes: {
-    options: { description: 'Option list whose values define the "all" set; matches the AntD Select option shape.' },
+    options: {
+      description:
+        'Option list whose values define the "all" set; matches the AntD Select option shape.',
+    },
     value: { description: 'Currently selected values (controlled).' },
-    onChange: { description: 'Called with the union of the current selection and every option value, or with an empty array on clear.' },
-    selectAllLabel: { description: 'Override for the "Select all" button text; defaults to the translated inbound copy.' },
-    clearLabel: { description: 'Override for the "Clear all" button text; defaults to the translated inbound copy.' },
+    onChange: {
+      description:
+        'Called with the union of the current selection and every option value, or with an empty array on clear.',
+    },
+    selectAllLabel: {
+      description:
+        'Override for the "Select all" button text; defaults to the translated inbound copy.',
+    },
+    clearLabel: {
+      description:
+        'Override for the "Clear all" button text; defaults to the translated inbound copy.',
+    },
   },
 } satisfies Meta<typeof SelectAllClearButtons>;
 

+ 1 - 5
frontend/src/components/form/SelectAllClearButtons.tsx

@@ -35,11 +35,7 @@ export default function SelectAllClearButtons<T extends string | number = number
       >
         {selectAllLabel ?? t('pages.clients.selectAllInbounds')}
       </Button>
-      <Button
-        size="small"
-        disabled={value.length === 0}
-        onClick={() => onChange([])}
-      >
+      <Button size="small" disabled={value.length === 0} onClick={() => onChange([])}>
         {clearLabel ?? t('pages.clients.clearAllInbounds')}
       </Button>
     </div>

+ 23 - 6
frontend/src/components/form/rhf/FormField.stories.tsx

@@ -25,14 +25,24 @@ const meta = {
   },
   argTypes: {
     name: { description: 'Field path — a dotted string or an array of segments joined with dots.' },
-    control: { description: 'Optional react-hook-form control; falls back to the surrounding FormProvider.' },
+    control: {
+      description: 'Optional react-hook-form control; falls back to the surrounding FormProvider.',
+    },
     label: { description: 'Form.Item label.' },
     tooltip: { description: 'Form.Item tooltip shown next to the label.' },
     extra: { description: 'Helper text rendered below the input.' },
-    valueProp: { description: 'Prop the child receives the value on: `value` (default) or `checked` for switches.' },
-    transform: { description: 'Optional input/output mappers, e.g. bytes stored in the form but GB shown in the input.' },
+    valueProp: {
+      description:
+        'Prop the child receives the value on: `value` (default) or `checked` for switches.',
+    },
+    transform: {
+      description:
+        'Optional input/output mappers, e.g. bytes stored in the form but GB shown in the input.',
+    },
     onAfterChange: { description: 'Called with the stored value after every change.' },
-    rules: { description: 'Controller-level validation rules applied on top of the form resolver.' },
+    rules: {
+      description: 'Controller-level validation rules applied on top of the form resolver.',
+    },
     required: { description: 'Marks the label with the required asterisk.' },
     noStyle: { description: 'Render the bare input without Form.Item chrome.' },
     children: { description: 'The single Ant Design control to wire up.' },
@@ -56,7 +66,12 @@ function ClientDemo() {
   return (
     <FormProvider {...methods}>
       <Form layout="vertical" style={{ maxWidth: 360 }}>
-        <FormField name="email" label="Email" tooltip="Unique identifier used to match client traffic" required>
+        <FormField
+          name="email"
+          label="Email"
+          tooltip="Unique identifier used to match client traffic"
+          required
+        >
           <Input placeholder="[email protected]" />
         </FormField>
         <FormField name="flow" label="Flow" extra="Only applies to VLESS over raw TLS">
@@ -96,7 +111,9 @@ function TrafficDemo() {
         >
           <InputNumber min={0} style={{ width: '100%' }} />
         </FormField>
-        <Typography.Text type="secondary">Form state: {totalBytes.toLocaleString()} bytes</Typography.Text>
+        <Typography.Text type="secondary">
+          Form state: {totalBytes.toLocaleString()} bytes
+        </Typography.Text>
       </Form>
     </FormProvider>
   );

+ 3 - 1
frontend/src/components/form/rhf/useZodForm.ts

@@ -7,7 +7,9 @@ export function useZodForm<TFieldValues extends FieldValues>(
   schema: z.ZodType<TFieldValues>,
   options?: Omit<UseFormProps<TFieldValues>, 'resolver'>,
 ): UseFormReturn<TFieldValues> {
-  const resolver = zodResolver(schema as z.ZodType<TFieldValues, TFieldValues>) as Resolver<TFieldValues>;
+  const resolver = zodResolver(
+    schema as z.ZodType<TFieldValues, TFieldValues>,
+  ) as Resolver<TFieldValues>;
   return useForm<TFieldValues>({
     mode: 'onSubmit',
     reValidateMode: 'onChange',

+ 515 - 108
frontend/src/components/geodata/GeoBrowserModal.stories.tsx

@@ -42,7 +42,9 @@ function deactivate(routes: GeoRoutes): void {
 function GeoApi({ routes, children }: { routes: GeoRoutes; children: ReactNode }) {
   const [client] = useState(() => {
     activate(routes);
-    return new QueryClient({ defaultOptions: { queries: { retry: false }, mutations: { retry: false } } });
+    return new QueryClient({
+      defaultOptions: { queries: { retry: false }, mutations: { retry: false } },
+    });
   });
   useEffect(() => {
     activate(routes);
@@ -61,121 +63,379 @@ const cross = (names: string[], suffixes: string[]): GeoEntry[] =>
   names.flatMap((name) => suffixes.map((suffix) => domain(`${name}.${suffix}`)));
 
 const CC_TLDS = [
-  'ae', 'al', 'am', 'at', 'az', 'ba', 'be', 'bg', 'bi', 'bj', 'ca', 'cat', 'cd', 'cf', 'cg', 'ch',
-  'ci', 'cl', 'cm', 'co.id', 'co.il', 'co.in', 'co.jp', 'co.ke', 'co.kr', 'co.ma', 'co.nz', 'co.th',
-  'co.uk', 'co.uz', 'co.ve', 'co.za', 'com.ar', 'com.au', 'com.bd', 'com.br', 'com.co', 'com.cu',
-  'com.eg', 'com.gt', 'com.hk', 'com.mx', 'com.my', 'com.ng', 'com.pe', 'com.ph', 'com.pk',
-  'com.sa', 'com.sg', 'com.tr', 'com.tw', 'com.ua', 'com.uy', 'com.vn', 'cz', 'de', 'dj', 'dk',
-  'dz', 'ee', 'es', 'fi', 'fr', 'ga', 'ge', 'gl', 'gm', 'gr', 'hn', 'hr', 'ht', 'hu', 'ie', 'iq',
-  'is', 'it', 'je', 'jo', 'kg', 'kz', 'la', 'li', 'lk', 'lt', 'lu', 'lv', 'ly', 'md', 'me', 'mg',
-  'mk', 'ml', 'mn', 'mu', 'mv', 'mw', 'ne', 'nl', 'no', 'nu', 'pl', 'pt', 'ro', 'rs', 'ru', 'rw',
-  'se', 'sh', 'si', 'sk', 'sm', 'sn', 'so', 'sr', 'st', 'td', 'tg', 'tk', 'tl', 'tm', 'tn', 'to',
-  'tt', 'vg', 'vu', 'ws',
+  'ae',
+  'al',
+  'am',
+  'at',
+  'az',
+  'ba',
+  'be',
+  'bg',
+  'bi',
+  'bj',
+  'ca',
+  'cat',
+  'cd',
+  'cf',
+  'cg',
+  'ch',
+  'ci',
+  'cl',
+  'cm',
+  'co.id',
+  'co.il',
+  'co.in',
+  'co.jp',
+  'co.ke',
+  'co.kr',
+  'co.ma',
+  'co.nz',
+  'co.th',
+  'co.uk',
+  'co.uz',
+  'co.ve',
+  'co.za',
+  'com.ar',
+  'com.au',
+  'com.bd',
+  'com.br',
+  'com.co',
+  'com.cu',
+  'com.eg',
+  'com.gt',
+  'com.hk',
+  'com.mx',
+  'com.my',
+  'com.ng',
+  'com.pe',
+  'com.ph',
+  'com.pk',
+  'com.sa',
+  'com.sg',
+  'com.tr',
+  'com.tw',
+  'com.ua',
+  'com.uy',
+  'com.vn',
+  'cz',
+  'de',
+  'dj',
+  'dk',
+  'dz',
+  'ee',
+  'es',
+  'fi',
+  'fr',
+  'ga',
+  'ge',
+  'gl',
+  'gm',
+  'gr',
+  'hn',
+  'hr',
+  'ht',
+  'hu',
+  'ie',
+  'iq',
+  'is',
+  'it',
+  'je',
+  'jo',
+  'kg',
+  'kz',
+  'la',
+  'li',
+  'lk',
+  'lt',
+  'lu',
+  'lv',
+  'ly',
+  'md',
+  'me',
+  'mg',
+  'mk',
+  'ml',
+  'mn',
+  'mu',
+  'mv',
+  'mw',
+  'ne',
+  'nl',
+  'no',
+  'nu',
+  'pl',
+  'pt',
+  'ro',
+  'rs',
+  'ru',
+  'rw',
+  'se',
+  'sh',
+  'si',
+  'sk',
+  'sm',
+  'sn',
+  'so',
+  'sr',
+  'st',
+  'td',
+  'tg',
+  'tk',
+  'tl',
+  'tm',
+  'tn',
+  'to',
+  'tt',
+  'vg',
+  'vu',
+  'ws',
 ];
 
 const AD_HOSTS = [
-  'adform', 'adnxs', 'adroll', 'adsrvr', 'amplitude', 'appsflyer', 'bluekai', 'branch',
-  'casalemedia', 'criteo', 'flurry', 'moatads', 'mopub', 'openx', 'outbrain', 'pubmatic',
-  'quantserve', 'rubiconproject', 'scorecardresearch', 'sharethrough', 'smartadserver', 'taboola',
-  'teads', 'yieldmo', 'zemanta',
+  'adform',
+  'adnxs',
+  'adroll',
+  'adsrvr',
+  'amplitude',
+  'appsflyer',
+  'bluekai',
+  'branch',
+  'casalemedia',
+  'criteo',
+  'flurry',
+  'moatads',
+  'mopub',
+  'openx',
+  'outbrain',
+  'pubmatic',
+  'quantserve',
+  'rubiconproject',
+  'scorecardresearch',
+  'sharethrough',
+  'smartadserver',
+  'taboola',
+  'teads',
+  'yieldmo',
+  'zemanta',
 ];
 
 const CN_BRANDS = [
-  '58', 'alibaba', 'alipay', 'aliyun', 'baidu', 'bilibili', 'cnblogs', 'csdn', 'ctrip', 'douban',
-  'gitee', 'huawei', 'iqiyi', 'jd', 'kuaishou', 'meituan', 'netease', 'pinduoduo', 'qq', 'sina',
-  'sohu', 'taobao', 'tencent', 'tmall', 'toutiao', 'weibo', 'xiaomi', 'youku', 'zhihu',
+  '58',
+  'alibaba',
+  'alipay',
+  'aliyun',
+  'baidu',
+  'bilibili',
+  'cnblogs',
+  'csdn',
+  'ctrip',
+  'douban',
+  'gitee',
+  'huawei',
+  'iqiyi',
+  'jd',
+  'kuaishou',
+  'meituan',
+  'netease',
+  'pinduoduo',
+  'qq',
+  'sina',
+  'sohu',
+  'taobao',
+  'tencent',
+  'tmall',
+  'toutiao',
+  'weibo',
+  'xiaomi',
+  'youku',
+  'zhihu',
 ];
 
 const SITE_ENTRIES: Record<string, GeoEntry[]> = {
   amazon: [
-    domain('amazon.com'), domain('amazonaws.com'), domain('media-amazon.com'),
-    domain('ssl-images-amazon.com'), domain('primevideo.com'), domain('awsstatic.com'),
-    domain('cloudfront.net'), full('www.amazon.co.jp'),
+    domain('amazon.com'),
+    domain('amazonaws.com'),
+    domain('media-amazon.com'),
+    domain('ssl-images-amazon.com'),
+    domain('primevideo.com'),
+    domain('awsstatic.com'),
+    domain('cloudfront.net'),
+    full('www.amazon.co.jp'),
   ],
   apple: [
-    domain('apple.com'), domain('icloud.com'), domain('cdn-apple.com'), domain('mzstatic.com'),
-    domain('apple-cloudkit.com'), domain('itunes.com'), domain('me.com'), domain('appstore.com'),
+    domain('apple.com'),
+    domain('icloud.com'),
+    domain('cdn-apple.com'),
+    domain('mzstatic.com'),
+    domain('apple-cloudkit.com'),
+    domain('itunes.com'),
+    domain('me.com'),
+    domain('appstore.com'),
   ],
   'category-ads': [
-    domain('adcolony.com'), domain('applovin.com'), domain('chartboost.com'),
-    domain('inmobi.com'), domain('unityads.unity3d.com'), keyword('banner-ad'),
+    domain('adcolony.com'),
+    domain('applovin.com'),
+    domain('chartboost.com'),
+    domain('inmobi.com'),
+    domain('unityads.unity3d.com'),
+    keyword('banner-ad'),
   ],
   'category-ads-all': [
-    domain('doubleclick.net'), domain('googleadservices.com'), domain('googlesyndication.com'),
-    domain('adservice.google.com'), full('ads.yahoo.com'), keyword('adservice'),
-    keyword('advertising'), regexp('^ad[0-9]{1,3}\\.'), ...cross(AD_HOSTS, ['com', 'net', 'io', 'ru']),
+    domain('doubleclick.net'),
+    domain('googleadservices.com'),
+    domain('googlesyndication.com'),
+    domain('adservice.google.com'),
+    full('ads.yahoo.com'),
+    keyword('adservice'),
+    keyword('advertising'),
+    regexp('^ad[0-9]{1,3}\\.'),
+    ...cross(AD_HOSTS, ['com', 'net', 'io', 'ru']),
   ],
   cloudflare: [
-    domain('cloudflare.com'), domain('cloudflare-dns.com'), domain('cloudflareinsights.com'),
-    domain('workers.dev'), domain('pages.dev'), domain('cf-ipfs.com'),
+    domain('cloudflare.com'),
+    domain('cloudflare-dns.com'),
+    domain('cloudflareinsights.com'),
+    domain('workers.dev'),
+    domain('pages.dev'),
+    domain('cf-ipfs.com'),
   ],
   cn: [full('www.gov.cn'), keyword('chinanet'), ...cross(CN_BRANDS, ['com', 'cn', 'com.cn'])],
   discord: [
-    domain('discord.com'), domain('discord.gg'), domain('discordapp.com'),
-    domain('discordapp.net'), domain('discord.media'),
+    domain('discord.com'),
+    domain('discord.gg'),
+    domain('discordapp.com'),
+    domain('discordapp.net'),
+    domain('discord.media'),
   ],
   facebook: [
-    domain('facebook.com'), domain('fbcdn.net'), domain('fb.com'), domain('messenger.com'),
-    domain('fbsbx.com'), domain('facebook.net'), full('m.facebook.com'),
+    domain('facebook.com'),
+    domain('fbcdn.net'),
+    domain('fb.com'),
+    domain('messenger.com'),
+    domain('fbsbx.com'),
+    domain('facebook.net'),
+    full('m.facebook.com'),
   ],
   'geolocation-!cn': [
-    keyword('proxy'), regexp('.*\\.onion$'), domain('wikipedia.org'), domain('bbc.com'),
-    domain('nytimes.com'), domain('reuters.com'), domain('medium.com'), domain('reddit.com'),
+    keyword('proxy'),
+    regexp('.*\\.onion$'),
+    domain('wikipedia.org'),
+    domain('bbc.com'),
+    domain('nytimes.com'),
+    domain('reuters.com'),
+    domain('medium.com'),
+    domain('reddit.com'),
   ],
   'geolocation-cn': [
-    domain('gov.cn'), domain('edu.cn'), domain('org.cn'), domain('net.cn'),
+    domain('gov.cn'),
+    domain('edu.cn'),
+    domain('org.cn'),
+    domain('net.cn'),
     ...cross(CN_BRANDS.slice(0, 18), ['cn']),
   ],
   github: [
-    domain('github.com'), domain('githubusercontent.com'), domain('githubassets.com'),
-    domain('github.io'), domain('ghcr.io'), domain('git.io'),
+    domain('github.com'),
+    domain('githubusercontent.com'),
+    domain('githubassets.com'),
+    domain('github.io'),
+    domain('ghcr.io'),
+    domain('git.io'),
   ],
   google: [
-    domain('google.com'), domain('googleapis.com'), domain('gstatic.com'),
-    domain('googleusercontent.com'), domain('google-analytics.com'), domain('googletagmanager.com'),
-    domain('ggpht.com'), domain('withgoogle.com'), domain('android.com'), domain('chromium.org'),
-    domain('abc.xyz'), full('dl.google.com'), ...CC_TLDS.map((tld) => domain(`google.${tld}`)),
+    domain('google.com'),
+    domain('googleapis.com'),
+    domain('gstatic.com'),
+    domain('googleusercontent.com'),
+    domain('google-analytics.com'),
+    domain('googletagmanager.com'),
+    domain('ggpht.com'),
+    domain('withgoogle.com'),
+    domain('android.com'),
+    domain('chromium.org'),
+    domain('abc.xyz'),
+    full('dl.google.com'),
+    ...CC_TLDS.map((tld) => domain(`google.${tld}`)),
   ],
   instagram: [domain('instagram.com'), domain('cdninstagram.com'), domain('ig.me')],
   microsoft: [
-    domain('microsoft.com'), domain('live.com'), domain('office.com'), domain('office365.com'),
-    domain('windows.net'), domain('windowsupdate.com'), domain('msn.com'), domain('azure.com'),
-    domain('sharepoint.com'), domain('skype.com'), domain('bing.com'),
+    domain('microsoft.com'),
+    domain('live.com'),
+    domain('office.com'),
+    domain('office365.com'),
+    domain('windows.net'),
+    domain('windowsupdate.com'),
+    domain('msn.com'),
+    domain('azure.com'),
+    domain('sharepoint.com'),
+    domain('skype.com'),
+    domain('bing.com'),
   ],
   netflix: [
-    domain('netflix.com'), domain('netflix.net'), domain('nflximg.com'), domain('nflximg.net'),
-    domain('nflxvideo.net'), domain('nflxso.net'), domain('nflxext.com'), full('fast.com'),
+    domain('netflix.com'),
+    domain('netflix.net'),
+    domain('nflximg.com'),
+    domain('nflximg.net'),
+    domain('nflxvideo.net'),
+    domain('nflxso.net'),
+    domain('nflxext.com'),
+    full('fast.com'),
   ],
   openai: [
-    domain('openai.com'), domain('chatgpt.com'), domain('oaistatic.com'),
-    domain('oaiusercontent.com'), domain('sora.com'),
+    domain('openai.com'),
+    domain('chatgpt.com'),
+    domain('oaistatic.com'),
+    domain('oaiusercontent.com'),
+    domain('sora.com'),
   ],
   spotify: [
-    domain('spotify.com'), domain('scdn.co'), domain('spotifycdn.com'), domain('spoti.fi'),
+    domain('spotify.com'),
+    domain('scdn.co'),
+    domain('spotifycdn.com'),
+    domain('spoti.fi'),
     domain('spotifycdn.net'),
   ],
   steam: [
-    domain('steampowered.com'), domain('steamcommunity.com'), domain('steamstatic.com'),
-    domain('steamcontent.com'), domain('valvesoftware.com'),
+    domain('steampowered.com'),
+    domain('steamcommunity.com'),
+    domain('steamstatic.com'),
+    domain('steamcontent.com'),
+    domain('valvesoftware.com'),
   ],
   telegram: [
-    domain('telegram.org'), domain('telegram.me'), domain('t.me'), domain('telesco.pe'),
-    domain('tdesktop.com'), domain('telegra.ph'), domain('cdn-telegram.org'),
-    full('comments.app'), keyword('telegram'),
+    domain('telegram.org'),
+    domain('telegram.me'),
+    domain('t.me'),
+    domain('telesco.pe'),
+    domain('tdesktop.com'),
+    domain('telegra.ph'),
+    domain('cdn-telegram.org'),
+    full('comments.app'),
+    keyword('telegram'),
   ],
   tiktok: [
-    domain('tiktok.com'), domain('tiktokcdn.com'), domain('tiktokv.com'),
-    domain('byteoversea.com'), domain('ibytedtos.com'), domain('musical.ly'),
+    domain('tiktok.com'),
+    domain('tiktokcdn.com'),
+    domain('tiktokv.com'),
+    domain('byteoversea.com'),
+    domain('ibytedtos.com'),
+    domain('musical.ly'),
   ],
   twitch: [domain('twitch.tv'), domain('ttvnw.net'), domain('jtvnw.net'), domain('twitchcdn.net')],
   twitter: [
-    domain('twitter.com'), domain('x.com'), domain('t.co'), domain('twimg.com'),
+    domain('twitter.com'),
+    domain('x.com'),
+    domain('t.co'),
+    domain('twimg.com'),
     domain('periscope.tv'),
   ],
   whatsapp: [domain('whatsapp.com'), domain('whatsapp.net'), domain('wa.me')],
   youtube: [
-    domain('youtube.com'), domain('youtu.be'), domain('ytimg.com'), domain('googlevideo.com'),
-    domain('youtube-nocookie.com'), domain('yt.be'),
+    domain('youtube.com'),
+    domain('youtu.be'),
+    domain('ytimg.com'),
+    domain('googlevideo.com'),
+    domain('youtube-nocookie.com'),
+    domain('yt.be'),
   ],
 };
 
@@ -192,68 +452,206 @@ const SITE_ATTRIBUTES: Record<string, string[]> = {
 };
 
 const CN_BLOCKS = [
-  '1.0.1.0/24', '1.0.2.0/23', '1.0.8.0/21', '14.0.12.0/22', '27.0.128.0/21', '36.0.0.0/22',
-  '39.0.0.0/24', '42.0.0.0/22', '58.14.0.0/15', '59.32.0.0/11', '61.128.0.0/10', '101.16.0.0/12',
-  '103.1.8.0/22', '106.0.0.0/10', '110.6.0.0/15', '111.0.0.0/10', '112.0.0.0/10', '113.0.0.0/9',
-  '114.28.0.0/16', '116.0.0.0/9', '117.8.0.0/13', '118.24.0.0/15', '119.0.0.0/9', '120.0.0.0/10',
-  '121.0.0.0/8', '124.0.0.0/8', '125.32.0.0/11', '139.196.0.0/14', '140.75.0.0/16', '175.0.0.0/12',
-  '180.76.0.0/16', '182.16.0.0/12', '183.0.0.0/10', '202.0.0.0/12', '203.0.0.0/12', '210.0.0.0/12',
-  '211.64.0.0/11', '218.0.0.0/9', '219.72.0.0/14', '220.112.0.0/12', '221.0.0.0/9', '222.16.0.0/12',
-  '2001:250::/35', '2400:3200::/32', '2408:8000::/20',
+  '1.0.1.0/24',
+  '1.0.2.0/23',
+  '1.0.8.0/21',
+  '14.0.12.0/22',
+  '27.0.128.0/21',
+  '36.0.0.0/22',
+  '39.0.0.0/24',
+  '42.0.0.0/22',
+  '58.14.0.0/15',
+  '59.32.0.0/11',
+  '61.128.0.0/10',
+  '101.16.0.0/12',
+  '103.1.8.0/22',
+  '106.0.0.0/10',
+  '110.6.0.0/15',
+  '111.0.0.0/10',
+  '112.0.0.0/10',
+  '113.0.0.0/9',
+  '114.28.0.0/16',
+  '116.0.0.0/9',
+  '117.8.0.0/13',
+  '118.24.0.0/15',
+  '119.0.0.0/9',
+  '120.0.0.0/10',
+  '121.0.0.0/8',
+  '124.0.0.0/8',
+  '125.32.0.0/11',
+  '139.196.0.0/14',
+  '140.75.0.0/16',
+  '175.0.0.0/12',
+  '180.76.0.0/16',
+  '182.16.0.0/12',
+  '183.0.0.0/10',
+  '202.0.0.0/12',
+  '203.0.0.0/12',
+  '210.0.0.0/12',
+  '211.64.0.0/11',
+  '218.0.0.0/9',
+  '219.72.0.0/14',
+  '220.112.0.0/12',
+  '221.0.0.0/9',
+  '222.16.0.0/12',
+  '2001:250::/35',
+  '2400:3200::/32',
+  '2408:8000::/20',
 ];
 
-const CN_EXTRA_BLOCKS = Array.from({ length: 96 }, (_, index) =>
-  `${39 + Math.floor(index / 16)}.${(index % 16) * 16}.0.0/12`,
+const CN_EXTRA_BLOCKS = Array.from(
+  { length: 96 },
+  (_, index) => `${39 + Math.floor(index / 16)}.${(index % 16) * 16}.0.0/12`,
 );
 
 const IP_ENTRIES: Record<string, GeoEntry[]> = {
   cloudflare: [
-    '103.21.244.0/22', '103.22.200.0/22', '103.31.4.0/22', '104.16.0.0/13', '104.24.0.0/14',
-    '108.162.192.0/18', '131.0.72.0/22', '141.101.64.0/18', '162.158.0.0/15', '172.64.0.0/13',
-    '173.245.48.0/20', '188.114.96.0/20', '190.93.240.0/20', '197.234.240.0/22', '198.41.128.0/17',
-    '2400:cb00::/32', '2606:4700::/32',
+    '103.21.244.0/22',
+    '103.22.200.0/22',
+    '103.31.4.0/22',
+    '104.16.0.0/13',
+    '104.24.0.0/14',
+    '108.162.192.0/18',
+    '131.0.72.0/22',
+    '141.101.64.0/18',
+    '162.158.0.0/15',
+    '172.64.0.0/13',
+    '173.245.48.0/20',
+    '188.114.96.0/20',
+    '190.93.240.0/20',
+    '197.234.240.0/22',
+    '198.41.128.0/17',
+    '2400:cb00::/32',
+    '2606:4700::/32',
   ].map(cidr),
   cn: [...CN_BLOCKS, ...CN_EXTRA_BLOCKS].map(cidr),
   facebook: [
-    '31.13.24.0/21', '31.13.64.0/18', '66.220.144.0/20', '69.63.176.0/20', '69.171.224.0/19',
-    '157.240.0.0/16', '179.60.192.0/22', '185.60.216.0/22', '2a03:2880::/32',
+    '31.13.24.0/21',
+    '31.13.64.0/18',
+    '66.220.144.0/20',
+    '69.63.176.0/20',
+    '69.171.224.0/19',
+    '157.240.0.0/16',
+    '179.60.192.0/22',
+    '185.60.216.0/22',
+    '2a03:2880::/32',
   ].map(cidr),
   google: [
-    '8.8.4.0/24', '8.8.8.0/24', '34.64.0.0/10', '35.184.0.0/13', '64.233.160.0/19', '66.102.0.0/20',
-    '72.14.192.0/18', '74.125.0.0/16', '108.177.8.0/21', '142.250.0.0/15', '172.217.0.0/16',
-    '216.58.192.0/19', '2404:6800::/32', '2607:f8b0::/32',
+    '8.8.4.0/24',
+    '8.8.8.0/24',
+    '34.64.0.0/10',
+    '35.184.0.0/13',
+    '64.233.160.0/19',
+    '66.102.0.0/20',
+    '72.14.192.0/18',
+    '74.125.0.0/16',
+    '108.177.8.0/21',
+    '142.250.0.0/15',
+    '172.217.0.0/16',
+    '216.58.192.0/19',
+    '2404:6800::/32',
+    '2607:f8b0::/32',
   ].map(cidr),
   ir: [
-    '2.144.0.0/14', '5.22.0.0/17', '31.2.128.0/17', '37.32.0.0/19', '46.32.0.0/19', '78.38.0.0/15',
-    '80.191.0.0/16', '85.15.0.0/18', '91.98.0.0/15', '178.22.72.0/21', '185.8.172.0/22',
-    '188.34.0.0/17', '217.218.0.0/15',
+    '2.144.0.0/14',
+    '5.22.0.0/17',
+    '31.2.128.0/17',
+    '37.32.0.0/19',
+    '46.32.0.0/19',
+    '78.38.0.0/15',
+    '80.191.0.0/16',
+    '85.15.0.0/18',
+    '91.98.0.0/15',
+    '178.22.72.0/21',
+    '185.8.172.0/22',
+    '188.34.0.0/17',
+    '217.218.0.0/15',
   ].map(cidr),
   netflix: [
-    '23.246.0.0/18', '37.77.184.0/21', '45.57.0.0/17', '64.120.128.0/17', '66.197.128.0/17',
-    '108.175.32.0/20', '185.2.220.0/22', '192.173.64.0/18', '198.38.96.0/19', '198.45.48.0/20',
+    '23.246.0.0/18',
+    '37.77.184.0/21',
+    '45.57.0.0/17',
+    '64.120.128.0/17',
+    '66.197.128.0/17',
+    '108.175.32.0/20',
+    '185.2.220.0/22',
+    '192.173.64.0/18',
+    '198.38.96.0/19',
+    '198.45.48.0/20',
   ].map(cidr),
   private: [
-    '0.0.0.0/8', '10.0.0.0/8', '100.64.0.0/10', '127.0.0.0/8', '169.254.0.0/16', '172.16.0.0/12',
-    '192.0.0.0/24', '192.0.2.0/24', '192.168.0.0/16', '198.18.0.0/15', '198.51.100.0/24',
-    '203.0.113.0/24', '224.0.0.0/4', '240.0.0.0/4', '255.255.255.255/32', '::1/128', 'fc00::/7',
+    '0.0.0.0/8',
+    '10.0.0.0/8',
+    '100.64.0.0/10',
+    '127.0.0.0/8',
+    '169.254.0.0/16',
+    '172.16.0.0/12',
+    '192.0.0.0/24',
+    '192.0.2.0/24',
+    '192.168.0.0/16',
+    '198.18.0.0/15',
+    '198.51.100.0/24',
+    '203.0.113.0/24',
+    '224.0.0.0/4',
+    '240.0.0.0/4',
+    '255.255.255.255/32',
+    '::1/128',
+    'fc00::/7',
     'fe80::/10',
   ].map(cidr),
   ru: [
-    '2.60.0.0/14', '5.8.0.0/19', '31.6.0.0/17', '37.9.0.0/19', '46.16.0.0/21', '62.76.0.0/18',
-    '77.37.128.0/17', '78.24.216.0/21', '79.104.0.0/15', '80.64.128.0/19', '81.16.96.0/19',
-    '82.140.128.0/18', '85.113.0.0/16', '87.226.0.0/16', '91.77.0.0/16', '93.157.0.0/17',
-    '94.19.0.0/16', '95.24.0.0/13', '178.176.0.0/13', '188.128.0.0/13', '213.87.0.0/16',
-    '217.66.152.0/21', '2a00:1148::/32',
+    '2.60.0.0/14',
+    '5.8.0.0/19',
+    '31.6.0.0/17',
+    '37.9.0.0/19',
+    '46.16.0.0/21',
+    '62.76.0.0/18',
+    '77.37.128.0/17',
+    '78.24.216.0/21',
+    '79.104.0.0/15',
+    '80.64.128.0/19',
+    '81.16.96.0/19',
+    '82.140.128.0/18',
+    '85.113.0.0/16',
+    '87.226.0.0/16',
+    '91.77.0.0/16',
+    '93.157.0.0/17',
+    '94.19.0.0/16',
+    '95.24.0.0/13',
+    '178.176.0.0/13',
+    '188.128.0.0/13',
+    '213.87.0.0/16',
+    '217.66.152.0/21',
+    '2a00:1148::/32',
   ].map(cidr),
   telegram: [
-    '91.108.4.0/22', '91.108.8.0/22', '91.108.12.0/22', '91.108.16.0/22', '91.108.20.0/22',
-    '91.108.56.0/22', '149.154.160.0/20', '2001:67c:4e8::/48', '2001:b28:f23d::/48',
+    '91.108.4.0/22',
+    '91.108.8.0/22',
+    '91.108.12.0/22',
+    '91.108.16.0/22',
+    '91.108.20.0/22',
+    '91.108.56.0/22',
+    '149.154.160.0/20',
+    '2001:67c:4e8::/48',
+    '2001:b28:f23d::/48',
     '2001:b28:f23f::/48',
   ].map(cidr),
   us: [
-    '3.0.0.0/9', '12.0.0.0/8', '23.192.0.0/11', '34.192.0.0/10', '50.16.0.0/14', '52.0.0.0/10',
-    '63.64.0.0/11', '65.0.0.0/10', '68.32.0.0/11', '71.0.0.0/11', '96.0.0.0/9', '128.0.0.0/10',
-    '199.0.0.0/12', '208.64.0.0/12', '2600:1f00::/24',
+    '3.0.0.0/9',
+    '12.0.0.0/8',
+    '23.192.0.0/11',
+    '34.192.0.0/10',
+    '50.16.0.0/14',
+    '52.0.0.0/10',
+    '63.64.0.0/11',
+    '65.0.0.0/10',
+    '68.32.0.0/11',
+    '71.0.0.0/11',
+    '96.0.0.0/9',
+    '128.0.0.0/10',
+    '199.0.0.0/12',
+    '208.64.0.0/12',
+    '2600:1f00::/24',
   ].map(cidr),
 };
 
@@ -305,10 +703,11 @@ const OVERSIZED_FILE: GeoFile = {
   error: 'geodata file is too large to browse',
 };
 
-const DATASETS: Record<string, { categories: GeoCategory[]; entries: Record<string, GeoEntry[]> }> = {
-  'geosite.dat': { categories: SITE_CATEGORIES, entries: SITE_ENTRIES },
-  'geoip.dat': { categories: IP_CATEGORIES, entries: IP_ENTRIES },
-};
+const DATASETS: Record<string, { categories: GeoCategory[]; entries: Record<string, GeoEntry[]> }> =
+  {
+    'geosite.dat': { categories: SITE_CATEGORIES, entries: SITE_ENTRIES },
+    'geoip.dat': { categories: IP_CATEGORIES, entries: IP_ENTRIES },
+  };
 
 function routesFor(files: GeoFile[]): GeoRoutes {
   return {
@@ -316,7 +715,9 @@ function routesFor(files: GeoFile[]): GeoRoutes {
     '/panel/api/xray/geodata/categories': (query) => {
       const dataset = DATASETS[query.get('file') ?? ''];
       const needle = (query.get('q') ?? '').trim().toLowerCase();
-      const items = (dataset?.categories ?? []).filter((category) => category.code.includes(needle));
+      const items = (dataset?.categories ?? []).filter((category) =>
+        category.code.includes(needle),
+      );
       return { total: items.length, items };
     },
     '/panel/api/xray/geodata/entries': (query) => {
@@ -348,10 +749,14 @@ const withDatabases = withFiles([GEOSITE_FILE, GEOIP_FILE]);
 function BrowserDemo(props: GeoBrowserModalProps) {
   const [open, setOpen] = useState(props.open);
   const [value, setValue] = useState(props.value);
-  useEffect(() => setOpen(props.open), [props.open]);
-  useEffect(() => setValue(props.value), [props.value]);
+  const [synced, setSynced] = useState({ open: props.open, value: props.value });
+  if (synced.open !== props.open || synced.value !== props.value) {
+    setSynced({ open: props.open, value: props.value });
+    setOpen(props.open);
+    setValue(props.value);
+  }
   return (
-    <Space direction="vertical" size={12}>
+    <Space orientation="vertical" size={12}>
       <Space size={8}>
         <Button onClick={() => setOpen(true)}>Open geo browser</Button>
         <Typography.Text code>{value || 'no rule yet'}</Typography.Text>
@@ -398,12 +803,14 @@ const meta = {
   argTypes: {
     open: { description: 'Whether the modal is visible.' },
     kind: {
-      description: 'Which database layout the rule targets: `site` for domain rules, `ip` for CIDR rules. Decides the preselected database and the token prefix.',
+      description:
+        'Which database layout the rule targets: `site` for domain rules, `ip` for CIDR rules. Decides the preselected database and the token prefix.',
       control: 'inline-radio',
       options: ['site', 'ip'],
     },
     value: {
-      description: 'Current rule string, comma separated. Tokens that match a category in the opened database come back preselected.',
+      description:
+        'Current rule string, comma separated. Tokens that match a category in the opened database come back preselected.',
     },
     onApply: { description: 'Called with the merged rule string when Apply is pressed.' },
     onClose: { description: 'Called when the modal is dismissed.' },

+ 107 - 47
frontend/src/components/geodata/GeoBrowserModal.tsx

@@ -1,6 +1,19 @@
-import { useCallback, useEffect, useMemo, useRef, useState } from 'react';
+import { useCallback, useEffect, useMemo, useState } from 'react';
 import { useTranslation } from 'react-i18next';
-import { Alert, Button, Empty, Input, Modal, Pagination, Select, Space, Table, Tag, Tooltip, Typography } from 'antd';
+import {
+  Alert,
+  Button,
+  Empty,
+  Input,
+  Modal,
+  Pagination,
+  Select,
+  Space,
+  Table,
+  Tag,
+  Tooltip,
+  Typography,
+} from 'antd';
 import type { ColumnsType } from 'antd/es/table';
 
 import { useGeodataCategories, useGeodataEntries, useGeodataFiles } from '@/api/queries/useGeodata';
@@ -25,7 +38,9 @@ export interface GeoBrowserModalProps {
 // A geosite category inside an ip rule (or the reverse) is a config Xray will
 // reject, so a field only ever offers databases of its own kind.
 function databasesFor(files: GeoFile[], kind: GeoKind): GeoFile[] {
-  return files.filter((file) => file.kind === kind || (file.error && namePrefersKind(file.name, kind)));
+  return files.filter(
+    (file) => file.kind === kind || (file.error && namePrefersKind(file.name, kind)),
+  );
 }
 
 function namePrefersKind(name: string, kind: GeoKind): boolean {
@@ -38,7 +53,13 @@ function preferredFile(files: GeoFile[], kind: GeoKind): string | undefined {
   return usable.find((file) => file.name === preferredName)?.name ?? usable[0]?.name;
 }
 
-export default function GeoBrowserModal({ open, kind, value, onApply, onClose }: GeoBrowserModalProps) {
+export default function GeoBrowserModal({
+  open,
+  kind,
+  value,
+  onApply,
+  onClose,
+}: GeoBrowserModalProps) {
   const { t } = useTranslation();
   const [file, setFile] = useState<string | undefined>(undefined);
   const [categoryQuery, setCategoryQuery] = useState('');
@@ -48,13 +69,16 @@ export default function GeoBrowserModal({ open, kind, value, onApply, onClose }:
   const [entryPage, setEntryPage] = useState(1);
   const [selected, setSelected] = useState<string[]>([]);
 
-  const knownRef = useRef<Set<string>>(new Set());
-  const seededFilesRef = useRef<Set<string>>(new Set());
+  const [known, setKnown] = useState<Set<string>>(() => new Set());
+  const [seededFiles, setSeededFiles] = useState<Set<string>>(() => new Set());
 
   const filesQuery = useGeodataFiles(open);
   const files = useMemo(() => databasesFor(filesQuery.data ?? [], kind), [filesQuery.data, kind]);
-  const activeFile = files.find((candidate) => candidate.name === file);
-  const fileKind: GeoKind = activeFile?.kind ?? kind;
+  const activeFile = useMemo(
+    () => files.find((candidate) => candidate.name === file),
+    [files, file],
+  );
+  const fileKind: GeoKind = useMemo(() => activeFile?.kind ?? kind, [activeFile, kind]);
 
   const categoriesQuery = useGeodataCategories(file, '', open && !!file);
   // While a newly picked database loads, the query still serves the previous
@@ -96,33 +120,35 @@ export default function GeoBrowserModal({ open, kind, value, onApply, onClose }:
     return () => window.clearTimeout(handle);
   }, [entryQuery, entryFilter]);
 
-  useEffect(() => {
-    if (!open) return;
-    knownRef.current = new Set();
-    seededFilesRef.current = new Set();
-    setCategoryQuery('');
-    setEntryQuery('');
-    setEntryFilter('');
-    setActiveCode(undefined);
-    setEntryPage(1);
-    setSelected([]);
-  }, [open]);
-
-  useEffect(() => {
-    if (!open || file || files.length === 0) return;
+  // Opening, picking the default database and seeding the selection are all
+  // render-time adjustments — an effect would paint the previous state first.
+  const [wasOpen, setWasOpen] = useState(false);
+  if (open !== wasOpen) {
+    setWasOpen(open);
+    if (open) {
+      setKnown(new Set());
+      setSeededFiles(new Set());
+      setCategoryQuery('');
+      setEntryQuery('');
+      setEntryFilter('');
+      setActiveCode(undefined);
+      setEntryPage(1);
+      setSelected([]);
+    }
+  } else if (open && !file && files.length > 0) {
     setFile(preferredFile(files, kind));
-  }, [open, file, files, kind]);
-
-  useEffect(() => {
-    if (!open || !file || categories.length === 0 || seededFilesRef.current.has(file)) return;
+  } else if (open && file && categories.length > 0 && !seededFiles.has(file)) {
     const tokens = categories.map((category) => tokenFor(file, category.code, fileKind));
-    for (const token of tokens) knownRef.current.add(token);
-    seededFilesRef.current.add(file);
+    setKnown(new Set([...known, ...tokens]));
+    setSeededFiles(new Set(seededFiles).add(file));
     const fromValue = selectionFromValue(value, new Set(tokens));
     if (fromValue.length > 0) {
-      setSelected((previous) => [...previous, ...fromValue.filter((token) => !previous.includes(token))]);
+      setSelected((previous) => [
+        ...previous,
+        ...fromValue.filter((token) => !previous.includes(token)),
+      ]);
     }
-  }, [open, file, categories, fileKind, value]);
+  }
 
   const visibleCategories = useMemo(() => {
     const query = categoryQuery.trim().toLowerCase();
@@ -149,7 +175,9 @@ export default function GeoBrowserModal({ open, kind, value, onApply, onClose }:
       // The table reports keys for the rows it currently shows, so a selection
       // made before the search box was narrowed must survive untouched.
       const shown = new Set(
-        visibleCategories.map((category) => canonicalToken(tokenFor(file, category.code, fileKind))),
+        visibleCategories.map((category) =>
+          canonicalToken(tokenFor(file, category.code, fileKind)),
+        ),
       );
       setSelected((previous) => {
         const kept = previous.filter((token) => {
@@ -157,7 +185,10 @@ export default function GeoBrowserModal({ open, kind, value, onApply, onClose }:
           return !shown.has(canonical) || chosenCanonical.has(canonical);
         });
         const keptCanonical = new Set(kept.map(canonicalToken));
-        return [...kept, ...[...chosen].filter((token) => !keptCanonical.has(canonicalToken(token)))];
+        return [
+          ...kept,
+          ...[...chosen].filter((token) => !keptCanonical.has(canonicalToken(token))),
+        ];
       });
     },
     [visibleCategories, file, fileKind],
@@ -174,7 +205,7 @@ export default function GeoBrowserModal({ open, kind, value, onApply, onClose }:
             {category.attributes?.length > 0 && (
               <span className="geo-attrs">
                 {category.attributes.map((attribute) => (
-                  <Tag key={attribute} bordered={false}>
+                  <Tag key={attribute} variant="filled">
                     @{attribute}
                   </Tag>
                 ))}
@@ -199,7 +230,7 @@ export default function GeoBrowserModal({ open, kind, value, onApply, onClose }:
         dataIndex: 'kind',
         width: 88,
         render: (entryKind: string) => (
-          <Tag bordered={false} className={`geo-kind geo-kind-${entryKind}`}>
+          <Tag variant="filled" className={`geo-kind geo-kind-${entryKind}`}>
             {entryKind}
           </Tag>
         ),
@@ -214,7 +245,9 @@ export default function GeoBrowserModal({ open, kind, value, onApply, onClose }:
 
   const fileOptions = files.map((candidate) => ({
     value: candidate.name,
-    label: candidate.error ? `${candidate.name} — ${describeFileError(candidate.error, t)}` : candidate.name,
+    label: candidate.error
+      ? `${candidate.name} — ${describeFileError(candidate.error, t)}`
+      : candidate.name,
     disabled: !!candidate.error,
   }));
 
@@ -229,9 +262,14 @@ export default function GeoBrowserModal({ open, kind, value, onApply, onClose }:
   const entriesTotal = entriesQuery.data?.total ?? 0;
   const activeCategory = categories.find((category) => category.code === activeCode);
   const countLabel = activeCategory
-    ? t(fileKind === 'ip' ? 'pages.xray.geoBrowser.subnetsCount' : 'pages.xray.geoBrowser.entriesCount', {
-        count: activeCategory.entries.toLocaleString(),
-      })
+    ? t(
+        fileKind === 'ip'
+          ? 'pages.xray.geoBrowser.subnetsCount'
+          : 'pages.xray.geoBrowser.entriesCount',
+        {
+          count: activeCategory.entries.toLocaleString(),
+        },
+      )
     : '';
 
   return (
@@ -240,12 +278,19 @@ export default function GeoBrowserModal({ open, kind, value, onApply, onClose }:
       title={t('pages.xray.geoBrowser.title')}
       width={880}
       onCancel={onClose}
-      onOk={() => onApply(mergeSelection(value, selected, knownRef.current))}
+      onOk={() => onApply(mergeSelection(value, selected, known))}
       okText={t('pages.xray.geoBrowser.apply')}
       cancelText={t('close')}
       className="geo-browser-modal"
     >
-      {filesQuery.isError && <Alert type="error" showIcon title={t('pages.xray.geoBrowser.loadFailed')} className="mb-12" />}
+      {filesQuery.isError && (
+        <Alert
+          type="error"
+          showIcon
+          title={t('pages.xray.geoBrowser.loadFailed')}
+          className="mb-12"
+        />
+      )}
 
       {!filesQuery.isError && !filesQuery.isLoading && files.length === 0 ? (
         <Empty
@@ -253,7 +298,9 @@ export default function GeoBrowserModal({ open, kind, value, onApply, onClose }:
             <span>
               {t('pages.xray.geoBrowser.noFiles')}
               <br />
-              <Typography.Text type="secondary">{t('pages.xray.geoBrowser.noFilesHint')}</Typography.Text>
+              <Typography.Text type="secondary">
+                {t('pages.xray.geoBrowser.noFilesHint')}
+              </Typography.Text>
             </span>
           }
         />
@@ -279,7 +326,9 @@ export default function GeoBrowserModal({ open, kind, value, onApply, onClose }:
               allowClear
             />
             <Button
-              onClick={() => toggle([...new Set([...selectedCodes, ...visibleCategories.map((c) => c.code)])])}
+              onClick={() =>
+                toggle([...new Set([...selectedCodes, ...visibleCategories.map((c) => c.code)])])
+              }
               disabled={visibleCategories.length === 0}
             >
               {`${t('pages.xray.geoBrowser.selectFound')} (${visibleCategories.length.toLocaleString()})`}
@@ -296,7 +345,11 @@ export default function GeoBrowserModal({ open, kind, value, onApply, onClose }:
                 rowKey="code"
                 columns={categoryColumns}
                 dataSource={visibleCategories}
-                loading={filesQuery.isLoading || categoriesQuery.isLoading || categoriesQuery.isPlaceholderData}
+                loading={
+                  filesQuery.isLoading ||
+                  categoriesQuery.isLoading ||
+                  categoriesQuery.isPlaceholderData
+                }
                 pagination={false}
                 scroll={{ y: CATEGORY_SCROLL_HEIGHT }}
                 locale={{ emptyText: t('pages.xray.geoBrowser.noMatches') }}
@@ -308,7 +361,8 @@ export default function GeoBrowserModal({ open, kind, value, onApply, onClose }:
                 }}
                 onRow={(category) => ({
                   onClick: (event) => {
-                    if ((event.target as HTMLElement).closest('.ant-table-selection-column')) return;
+                    if ((event.target as HTMLElement).closest('.ant-table-selection-column'))
+                      return;
                     setActiveCode(category.code);
                     clearEntryFilter();
                   },
@@ -369,7 +423,9 @@ export default function GeoBrowserModal({ open, kind, value, onApply, onClose }:
                 </>
               ) : (
                 <div className="geo-placeholder">
-                  <Typography.Text type="secondary">{t('pages.xray.geoBrowser.pickCategory')}</Typography.Text>
+                  <Typography.Text type="secondary">
+                    {t('pages.xray.geoBrowser.pickCategory')}
+                  </Typography.Text>
                 </div>
               )}
             </div>
@@ -377,7 +433,9 @@ export default function GeoBrowserModal({ open, kind, value, onApply, onClose }:
 
           <div className="geo-footer">
             {selected.length === 0 ? (
-              <Typography.Text type="secondary">{t('pages.xray.geoBrowser.emptySelection')}</Typography.Text>
+              <Typography.Text type="secondary">
+                {t('pages.xray.geoBrowser.emptySelection')}
+              </Typography.Text>
             ) : (
               <>
                 <Space size={4} wrap className="geo-chips">
@@ -386,7 +444,9 @@ export default function GeoBrowserModal({ open, kind, value, onApply, onClose }:
                       key={token}
                       closable
                       color="processing"
-                      onClose={() => setSelected((previous) => previous.filter((item) => item !== token))}
+                      onClose={() =>
+                        setSelected((previous) => previous.filter((item) => item !== token))
+                      }
                     >
                       {token}
                     </Tag>

+ 70 - 21
frontend/src/components/geodata/GeoTokenInput.stories.tsx

@@ -44,7 +44,9 @@ function deactivate(routes: GeoRoutes): void {
 function GeoApi({ routes, children }: { routes: GeoRoutes; children: ReactNode }) {
   const [client] = useState(() => {
     activate(routes);
-    return new QueryClient({ defaultOptions: { queries: { retry: false }, mutations: { retry: false } } });
+    return new QueryClient({
+      defaultOptions: { queries: { retry: false }, mutations: { retry: false } },
+    });
   });
   useEffect(() => {
     activate(routes);
@@ -58,25 +60,55 @@ const cidr = (value: string): GeoEntry => ({ kind: 'cidr', value });
 
 const SITE_ENTRIES: Record<string, GeoEntry[]> = {
   'category-ads-all': [
-    domain('doubleclick.net'), domain('googleadservices.com'), domain('googlesyndication.com'),
-    domain('criteo.com'), domain('taboola.com'), domain('outbrain.com'),
+    domain('doubleclick.net'),
+    domain('googleadservices.com'),
+    domain('googlesyndication.com'),
+    domain('criteo.com'),
+    domain('taboola.com'),
+    domain('outbrain.com'),
+  ],
+  cn: [
+    domain('baidu.com'),
+    domain('qq.com'),
+    domain('taobao.com'),
+    domain('weibo.com'),
+    domain('bilibili.com'),
   ],
-  cn: [domain('baidu.com'), domain('qq.com'), domain('taobao.com'), domain('weibo.com'), domain('bilibili.com')],
   google: [
-    domain('google.com'), domain('googleapis.com'), domain('gstatic.com'),
-    domain('googleusercontent.com'), domain('ggpht.com'), domain('android.com'),
+    domain('google.com'),
+    domain('googleapis.com'),
+    domain('gstatic.com'),
+    domain('googleusercontent.com'),
+    domain('ggpht.com'),
+    domain('android.com'),
+  ],
+  netflix: [
+    domain('netflix.com'),
+    domain('nflximg.net'),
+    domain('nflxvideo.net'),
+    domain('fast.com'),
   ],
-  netflix: [domain('netflix.com'), domain('nflximg.net'), domain('nflxvideo.net'), domain('fast.com')],
   telegram: [domain('telegram.org'), domain('t.me'), domain('telesco.pe'), domain('telegra.ph')],
-  youtube: [domain('youtube.com'), domain('youtu.be'), domain('ytimg.com'), domain('googlevideo.com')],
+  youtube: [
+    domain('youtube.com'),
+    domain('youtu.be'),
+    domain('ytimg.com'),
+    domain('googlevideo.com'),
+  ],
 };
 
 const IP_ENTRIES: Record<string, GeoEntry[]> = {
   cloudflare: ['104.16.0.0/13', '172.64.0.0/13', '2606:4700::/32'].map(cidr),
   cn: ['1.0.1.0/24', '36.0.0.0/22', '116.0.0.0/9', '2408:8000::/20'].map(cidr),
   private: [
-    '10.0.0.0/8', '127.0.0.0/8', '169.254.0.0/16', '172.16.0.0/12', '192.168.0.0/16',
-    '::1/128', 'fc00::/7', 'fe80::/10',
+    '10.0.0.0/8',
+    '127.0.0.0/8',
+    '169.254.0.0/16',
+    '172.16.0.0/12',
+    '192.168.0.0/16',
+    '::1/128',
+    'fc00::/7',
+    'fe80::/10',
   ].map(cidr),
   telegram: ['91.108.4.0/22', '149.154.160.0/20', '2001:b28:f23d::/48'].map(cidr),
 };
@@ -95,10 +127,14 @@ function categoriesOf(
     .map((code) => ({ code, entries: entries[code].length, attributes: attributes[code] ?? [] }));
 }
 
-const DATASETS: Record<string, { categories: GeoCategory[]; entries: Record<string, GeoEntry[]> }> = {
-  'geosite.dat': { categories: categoriesOf(SITE_ENTRIES, SITE_ATTRIBUTES), entries: SITE_ENTRIES },
-  'geoip.dat': { categories: categoriesOf(IP_ENTRIES), entries: IP_ENTRIES },
-};
+const DATASETS: Record<string, { categories: GeoCategory[]; entries: Record<string, GeoEntry[]> }> =
+  {
+    'geosite.dat': {
+      categories: categoriesOf(SITE_ENTRIES, SITE_ATTRIBUTES),
+      entries: SITE_ENTRIES,
+    },
+    'geoip.dat': { categories: categoriesOf(IP_ENTRIES), entries: IP_ENTRIES },
+  };
 
 const UPDATED_AT = Date.UTC(2026, 6, 24, 3, 12);
 
@@ -125,7 +161,9 @@ function referenceOf(token: string, isIP: boolean): { file: string; code: string
   if (prefix === 'geosite') return { file: 'geosite.dat', code: code(rest.join(':')) };
   if (prefix === 'geoip') return { file: 'geoip.dat', code: code(rest.join(':')) };
   if (prefix === 'ext') return { file: rest[0] ?? '', code: code(rest.slice(1).join(':')) };
-  return isIP && prefix === 'ext-ip' ? { file: rest[0] ?? '', code: code(rest.slice(1).join(':')) } : null;
+  return isIP && prefix === 'ext-ip'
+    ? { file: rest[0] ?? '', code: code(rest.slice(1).join(':')) }
+    : null;
 }
 
 function validate(tokens: string[], isIP: boolean): GeodataTokenIssue[] {
@@ -178,9 +216,13 @@ const withGeodata: Decorator = function GeodataBackend(Story) {
 
 function ControlledTokenInput({ value = '', id = 'geo-rule', ...rest }: GeoTokenInputProps) {
   const [current, setCurrent] = useState(value);
-  useEffect(() => setCurrent(value), [value]);
+  const [synced, setSynced] = useState(value);
+  if (synced !== value) {
+    setSynced(value);
+    setCurrent(value);
+  }
   return (
-    <Space direction="vertical" size={4} style={{ width: 460 }}>
+    <Space orientation="vertical" size={4} style={{ width: 460 }}>
       <label htmlFor={id}>{rest.kind === 'ip' ? 'Target IP' : 'Target domain'}</label>
       <GeoTokenInput {...rest} id={id} value={current} onChange={setCurrent} />
     </Space>
@@ -209,10 +251,15 @@ const meta = {
   args: { kind: 'domain' },
   argTypes: {
     value: { description: 'Comma separated rule string held by the parent form.' },
-    onChange: { description: 'Called with the full rule string on every edit and on Apply from the browser.' },
-    onBlur: { description: 'Forwarded to the input; used by React Hook Form to mark the field touched.' },
+    onChange: {
+      description: 'Called with the full rule string on every edit and on Apply from the browser.',
+    },
+    onBlur: {
+      description: 'Forwarded to the input; used by React Hook Form to mark the field touched.',
+    },
     kind: {
-      description: 'Which database the tokens are validated against: `domain` for geosite, `ip` for geoip.',
+      description:
+        'Which database the tokens are validated against: `domain` for geosite, `ip` for geoip.',
       control: 'inline-radio',
       options: ['domain', 'ip'],
     },
@@ -242,6 +289,8 @@ export const UnknownCategory: Story = {
   args: { kind: 'domain', value: 'geosite:blabla, geosite:google' },
   play: async ({ canvasElement }) => {
     const canvas = within(canvasElement);
-    await expect(await canvas.findByText(/geosite:blabla/, undefined, { timeout: 3000 })).toBeVisible();
+    await expect(
+      await canvas.findByText(/geosite:blabla/, undefined, { timeout: 3000 }),
+    ).toBeVisible();
   },
 };

+ 39 - 25
frontend/src/components/geodata/GeoTokenInput.tsx

@@ -1,7 +1,7 @@
 import { useEffect, useState } from 'react';
 import type { Ref } from 'react';
 import { useTranslation } from 'react-i18next';
-import { Button, Input, Tooltip, Typography } from 'antd';
+import { Button, Input, Space, Tooltip, Typography } from 'antd';
 import type { InputRef } from 'antd';
 import { DatabaseOutlined } from '@ant-design/icons';
 
@@ -33,7 +33,15 @@ export interface GeoTokenInputProps {
   ref?: Ref<InputRef>;
 }
 
-export default function GeoTokenInput({ value = '', onChange, onBlur, kind, placeholder, id, ref }: GeoTokenInputProps) {
+export default function GeoTokenInput({
+  value = '',
+  onChange,
+  onBlur,
+  kind,
+  placeholder,
+  id,
+  ref,
+}: GeoTokenInputProps) {
   const { t } = useTranslation();
   const [browsing, setBrowsing] = useState(false);
   const [issues, setIssues] = useState<GeodataTokenIssue[]>([]);
@@ -41,13 +49,21 @@ export default function GeoTokenInput({ value = '', onChange, onBlur, kind, plac
   const validate = useValidateGeoTokens();
   const { mutateAsync } = validate;
 
-  useEffect(() => {
-    const tokens = parseTokens(value);
-    if (tokens.length === 0) {
+  // An empty field has nothing to validate, so it clears during render rather
+  // than waiting a commit for the effect to catch up.
+  const isEmpty = parseTokens(value).length === 0;
+  const [wasEmpty, setWasEmpty] = useState(isEmpty);
+  if (isEmpty !== wasEmpty) {
+    setWasEmpty(isEmpty);
+    if (isEmpty) {
       setIssues([]);
       setCheckFailed(false);
-      return;
     }
+  }
+
+  useEffect(() => {
+    const tokens = parseTokens(value);
+    if (tokens.length === 0) return;
     let cancelled = false;
     const timer = setTimeout(() => {
       mutateAsync({ tokens, kind })
@@ -72,25 +88,23 @@ export default function GeoTokenInput({ value = '', onChange, onBlur, kind, plac
 
   return (
     <>
-      <Input
-        ref={ref}
-        id={id}
-        value={value}
-        placeholder={placeholder}
-        onChange={(event) => onChange?.(event.target.value)}
-        onBlur={onBlur}
-        addonAfter={
-          <Tooltip title={t('pages.xray.geoBrowser.openTooltip')}>
-            <Button
-              type="text"
-              size="small"
-              icon={<DatabaseOutlined />}
-              aria-label={t('pages.xray.geoBrowser.openTooltip')}
-              onClick={() => setBrowsing(true)}
-            />
-          </Tooltip>
-        }
-      />
+      <Space.Compact block>
+        <Input
+          ref={ref}
+          id={id}
+          value={value}
+          placeholder={placeholder}
+          onChange={(event) => onChange?.(event.target.value)}
+          onBlur={onBlur}
+        />
+        <Tooltip title={t('pages.xray.geoBrowser.openTooltip')}>
+          <Button
+            icon={<DatabaseOutlined />}
+            aria-label={t('pages.xray.geoBrowser.openTooltip')}
+            onClick={() => setBrowsing(true)}
+          />
+        </Tooltip>
+      </Space.Compact>
       {groupByReason(issues).map(([reason, tokens]) => (
         <Typography.Text key={reason} type="warning" className="geo-unknown-hint">
           {t(REASON_KEYS[reason] ?? REASON_KEYS.categoryMissing, { tokens: tokens.join(', ') })}

+ 4 - 1
frontend/src/components/ui/DefaultSettingTag.tsx

@@ -8,7 +8,10 @@ import { useFactoryDefaults } from '@/api/queries/useFactoryDefaults';
  * default?", not "has the user ever saved this key?" — a stored 2096 and a
  * fallback 2096 behave identically, so they read identically.
  */
-export function matchesFactoryDefault(current: unknown, factoryDefault: string | undefined): boolean {
+export function matchesFactoryDefault(
+  current: unknown,
+  factoryDefault: string | undefined,
+): boolean {
   if (factoryDefault === undefined) return false;
   if (typeof current === 'number') {
     const parsed = Number(factoryDefault);

+ 10 - 1
frontend/src/components/ui/InputAddon.tsx

@@ -10,8 +10,17 @@ interface InputAddonProps {
   ariaLabel?: string;
 }
 
-export default function InputAddon({ children, className = '', style, onClick, ariaLabel }: InputAddonProps) {
+export default function InputAddon({
+  children,
+  className = '',
+  style,
+  onClick,
+  ariaLabel,
+}: InputAddonProps) {
   return (
+    // oxlint cannot see through the conditional role/tabIndex/onKeyDown below,
+    // which is exactly what makes the clickable variant accessible.
+    // oxlint-disable-next-line jsx-a11y/no-static-element-interactions
     <span
       className={`input-addon ${className}`.trim()}
       style={style}

+ 14 - 4
frontend/src/components/ui/SettingListItem.tsx

@@ -1,4 +1,11 @@
-import { cloneElement, Fragment, isValidElement, useId, type ReactElement, type ReactNode } from 'react';
+import {
+  cloneElement,
+  Fragment,
+  isValidElement,
+  useId,
+  type ReactElement,
+  type ReactNode,
+} from 'react';
 import { Col, Row } from 'antd';
 import './SettingListItem.css';
 
@@ -22,9 +29,12 @@ export default function SettingListItem({
   const padding = paddings === 'small' ? '10px 20px' : '20px';
   const titleId = useId();
   const node = control ?? children;
-  const labelledNode = title && isValidElement(node) && node.type !== Fragment
-    ? cloneElement(node as ReactElement<{ 'aria-labelledby'?: string }>, { 'aria-labelledby': titleId })
-    : node;
+  const labelledNode =
+    title && isValidElement(node) && node.type !== Fragment
+      ? cloneElement(node as ReactElement<{ 'aria-labelledby'?: string }>, {
+          'aria-labelledby': titleId,
+        })
+      : node;
   return (
     <div className="setting-list-item" style={{ padding }}>
       <Row gutter={[8, 16]} style={{ width: '100%' }}>

+ 8 - 3
frontend/src/components/ui/notifications/EmailNotifications.stories.tsx

@@ -23,7 +23,8 @@ const meta = {
         'Panel settings snapshot; smtpEnabledEvents holds the selected event keys and smtpCpu/smtpMemory the alert threshold percentages.',
     },
     updateSetting: {
-      description: 'Receives a partial settings patch when an event is toggled or a threshold input changes.',
+      description:
+        'Receives a partial settings patch when an event is toggled or a threshold input changes.',
     },
   },
 } satisfies Meta<typeof EmailNotifications>;
@@ -56,7 +57,9 @@ export const SystemThresholdAlerts: Story = {
   args: placeholderArgs,
   render: () => (
     <StatefulDemo
-      initial={new AllSetting({ smtpEnabledEvents: 'cpu.high,memory.high', smtpCpu: 85, smtpMemory: 90 })}
+      initial={
+        new AllSetting({ smtpEnabledEvents: 'cpu.high,memory.high', smtpCpu: 85, smtpMemory: 90 })
+      }
     />
   ),
 };
@@ -64,7 +67,9 @@ export const SystemThresholdAlerts: Story = {
 export const InfrastructureOnly: Story = {
   args: placeholderArgs,
   render: () => (
-    <StatefulDemo initial={new AllSetting({ smtpEnabledEvents: 'outbound.down,node.down,node.up,xray.crash' })} />
+    <StatefulDemo
+      initial={new AllSetting({ smtpEnabledEvents: 'outbound.down,node.down,node.up,xray.crash' })}
+    />
   ),
 };
 

+ 43 - 14
frontend/src/components/ui/notifications/EmailNotifications.tsx

@@ -1,5 +1,11 @@
 import { InputNumber } from 'antd';
-import { CloudServerOutlined, ThunderboltOutlined, DesktopOutlined, DashboardOutlined, SafetyOutlined } from '@ant-design/icons';
+import {
+  CloudServerOutlined,
+  ThunderboltOutlined,
+  DesktopOutlined,
+  DashboardOutlined,
+  SafetyOutlined,
+} from '@ant-design/icons';
 import type { AllSetting } from '@/models/setting';
 import { NotificationLayout } from './NotificationLayout';
 import { NotificationGroup } from './NotificationGroup';
@@ -15,7 +21,15 @@ const GROUPS: NotificationGroupConfig[] = [
         label: 'eventOutboundDown',
         settingKey: 'outboundDownThreshold',
         extra: ({ value, onChange, ariaLabel }) => (
-          <InputNumber size="small" min={1} max={100} value={value} onChange={onChange} aria-label={ariaLabel} style={{ width: 80 }} />
+          <InputNumber
+            size="small"
+            min={1}
+            max={100}
+            value={value}
+            onChange={onChange}
+            aria-label={ariaLabel}
+            style={{ width: 80 }}
+          />
         ),
       },
       { key: 'outbound.up', label: 'eventOutboundUp', settingKey: '' },
@@ -24,9 +38,7 @@ const GROUPS: NotificationGroupConfig[] = [
   {
     icon: <ThunderboltOutlined />,
     title: 'eventGroupXray',
-    events: [
-      { key: 'xray.crash', label: 'eventXrayCrash', settingKey: '' },
-    ],
+    events: [{ key: 'xray.crash', label: 'eventXrayCrash', settingKey: '' }],
   },
   {
     icon: <DesktopOutlined />,
@@ -45,7 +57,15 @@ const GROUPS: NotificationGroupConfig[] = [
         label: 'eventCPUHigh',
         settingKey: 'smtpCpu',
         extra: ({ value, onChange, ariaLabel }) => (
-          <InputNumber size="small" min={0} max={100} value={value} onChange={onChange} aria-label={ariaLabel} style={{ width: 80 }} />
+          <InputNumber
+            size="small"
+            min={0}
+            max={100}
+            value={value}
+            onChange={onChange}
+            aria-label={ariaLabel}
+            style={{ width: 80 }}
+          />
         ),
       },
       {
@@ -53,7 +73,15 @@ const GROUPS: NotificationGroupConfig[] = [
         label: 'eventMemoryHigh',
         settingKey: 'smtpMemory',
         extra: ({ value, onChange, ariaLabel }) => (
-          <InputNumber size="small" min={0} max={100} value={value} onChange={onChange} aria-label={ariaLabel} style={{ width: 80 }} />
+          <InputNumber
+            size="small"
+            min={0}
+            max={100}
+            value={value}
+            onChange={onChange}
+            aria-label={ariaLabel}
+            style={{ width: 80 }}
+          />
         ),
       },
     ],
@@ -61,9 +89,7 @@ const GROUPS: NotificationGroupConfig[] = [
   {
     icon: <SafetyOutlined />,
     title: 'eventGroupSecurity',
-    events: [
-      { key: 'login.attempt', label: 'eventLoginAttempt', settingKey: '' },
-    ],
+    events: [{ key: 'login.attempt', label: 'eventLoginAttempt', settingKey: '' }],
   },
 ];
 
@@ -74,12 +100,15 @@ interface Props {
 
 export function EmailNotifications({ allSetting, updateSetting }: Props) {
   const events = allSetting.smtpEnabledEvents || '';
-  const selected = events ? events.split(',').map((s) => s.trim()).filter(Boolean) : [];
+  const selected = events
+    ? events
+        .split(',')
+        .map((s) => s.trim())
+        .filter(Boolean)
+    : [];
 
   function toggle(key: string) {
-    const next = selected.includes(key)
-      ? selected.filter((e) => e !== key)
-      : [...selected, key];
+    const next = selected.includes(key) ? selected.filter((e) => e !== key) : [...selected, key];
     updateSetting({ smtpEnabledEvents: next.join(',') });
   }
 

+ 5 - 1
frontend/src/components/ui/notifications/NotificationCard.tsx

@@ -13,7 +13,11 @@ export function NotificationCard({ icon, title, extra, children }: Props) {
     <Card
       size="small"
       variant="outlined"
-      title={<span>{icon} {title}</span>}
+      title={
+        <span>
+          {icon} {title}
+        </span>
+      }
       extra={extra}
       style={{ borderWidth: 1 }}
     >

+ 1 - 5
frontend/src/components/ui/notifications/NotificationEvent.tsx

@@ -16,11 +16,7 @@ export function NotificationEvent({ label, checked, onToggle, children }: Props)
       <Checkbox checked={checked} onChange={onToggle}>
         {t(label)}
       </Checkbox>
-      {checked && children && (
-        <div style={{ paddingLeft: 24, marginTop: 4 }}>
-          {children}
-        </div>
-      )}
+      {checked && children && <div style={{ paddingLeft: 24, marginTop: 4 }}>{children}</div>}
     </div>
   );
 }

+ 36 - 7
frontend/src/components/ui/notifications/NotificationGroup.stories.tsx

@@ -16,7 +16,15 @@ const systemGroup: NotificationGroupConfig = {
       label: 'eventCPUHigh',
       settingKey: 'tgCpu',
       extra: ({ value, onChange, ariaLabel }) => (
-        <InputNumber size="small" min={0} max={100} value={value} onChange={onChange} aria-label={ariaLabel} style={{ width: 80 }} />
+        <InputNumber
+          size="small"
+          min={0}
+          max={100}
+          value={value}
+          onChange={onChange}
+          aria-label={ariaLabel}
+          style={{ width: 80 }}
+        />
       ),
     },
     {
@@ -24,7 +32,15 @@ const systemGroup: NotificationGroupConfig = {
       label: 'eventMemoryHigh',
       settingKey: 'tgMemory',
       extra: ({ value, onChange, ariaLabel }) => (
-        <InputNumber size="small" min={0} max={100} value={value} onChange={onChange} aria-label={ariaLabel} style={{ width: 80 }} />
+        <InputNumber
+          size="small"
+          min={0}
+          max={100}
+          value={value}
+          onChange={onChange}
+          aria-label={ariaLabel}
+          style={{ width: 80 }}
+        />
       ),
     },
   ],
@@ -53,12 +69,21 @@ const meta = {
     },
   },
   argTypes: {
-    config: { description: 'Group definition: icon, `pages.settings` title key, and the event rows to render.' },
+    config: {
+      description:
+        'Group definition: icon, `pages.settings` title key, and the event rows to render.',
+    },
     selected: { description: 'Enabled event keys; drives each checkbox and the header count.' },
     onToggle: { description: 'Called with the event key when a single checkbox is clicked.' },
-    onToggleAll: { description: 'Called with every event key in the group when the master checkbox is clicked.' },
-    allSetting: { description: 'Panel settings snapshot; threshold values such as `tgCpu` are read from it.' },
-    updateSetting: { description: 'Called with a partial settings patch when a threshold input changes.' },
+    onToggleAll: {
+      description: 'Called with every event key in the group when the master checkbox is clicked.',
+    },
+    allSetting: {
+      description: 'Panel settings snapshot; threshold values such as `tgCpu` are read from it.',
+    },
+    updateSetting: {
+      description: 'Called with a partial settings patch when a threshold input changes.',
+    },
   },
 } satisfies Meta<typeof NotificationGroup>;
 
@@ -77,7 +102,11 @@ function Demo() {
         setSelected((prev) => (prev.includes(key) ? prev.filter((k) => k !== key) : [...prev, key]))
       }
       onToggleAll={(keys) =>
-        setSelected((prev) => (keys.every((k) => prev.includes(k)) ? prev.filter((k) => !keys.includes(k)) : [...new Set([...prev, ...keys])]))
+        setSelected((prev) =>
+          keys.every((k) => prev.includes(k))
+            ? prev.filter((k) => !keys.includes(k))
+            : [...new Set([...prev, ...keys])],
+        )
       }
       allSetting={settings}
       updateSetting={(patch) => setSettings((prev) => new AllSetting({ ...prev, ...patch }))}

+ 10 - 2
frontend/src/components/ui/notifications/NotificationGroup.tsx

@@ -15,7 +15,14 @@ interface Props {
   updateSetting: (patch: Partial<AllSetting>) => void;
 }
 
-export function NotificationGroup({ config, selected, onToggle, onToggleAll, allSetting, updateSetting }: Props) {
+export function NotificationGroup({
+  config,
+  selected,
+  onToggle,
+  onToggleAll,
+  allSetting,
+  updateSetting,
+}: Props) {
   const { t } = useTranslation();
 
   const count = config.events.filter((e) => selected.includes(e.key)).length;
@@ -49,7 +56,8 @@ export function NotificationGroup({ config, selected, onToggle, onToggleAll, all
             onToggle={() => onToggle(event.key)}
           >
             {event.extra?.({
-              value: Number((allSetting as unknown as Record<string, unknown>)[event.settingKey]) || 0,
+              value:
+                Number((allSetting as unknown as Record<string, unknown>)[event.settingKey]) || 0,
               onChange: (v) => updateSetting({ [event.settingKey]: v }),
               ariaLabel: t(`pages.settings.${event.label}`),
             })}

+ 3 - 1
frontend/src/components/ui/notifications/NotificationHeader.stories.tsx

@@ -22,7 +22,9 @@ const meta = {
     total: { description: 'Total number of events the group offers.' },
     allSelected: { description: 'Checks the master checkbox when every event is selected.' },
     indeterminate: { description: 'Shows the dash state when only some events are selected.' },
-    onToggleAll: { description: 'Called when the master checkbox is clicked to select or clear all events.' },
+    onToggleAll: {
+      description: 'Called when the master checkbox is clicked to select or clear all events.',
+    },
   },
 } satisfies Meta<typeof NotificationHeader>;
 

+ 29 - 4
frontend/src/components/ui/notifications/NotificationHeader.tsx

@@ -10,19 +10,44 @@ interface Props {
   onToggleAll: () => void;
 }
 
-function MasterCheckbox({ checked, indeterminate, onChange }: { checked: boolean; indeterminate: boolean; onChange: () => void }) {
+function MasterCheckbox({
+  checked,
+  indeterminate,
+  onChange,
+}: {
+  checked: boolean;
+  indeterminate: boolean;
+  onChange: () => void;
+}) {
   const { t } = useTranslation();
   const ref = useRef<HTMLInputElement>(null);
   useEffect(() => {
     if (ref.current) ref.current.indeterminate = indeterminate;
   }, [indeterminate]);
-  return <input ref={ref} type="checkbox" aria-label={t('pages.clients.selectAll')} checked={checked} onChange={onChange} style={{ cursor: 'pointer' }} />;
+  return (
+    <input
+      ref={ref}
+      type="checkbox"
+      aria-label={t('pages.clients.selectAll')}
+      checked={checked}
+      onChange={onChange}
+      style={{ cursor: 'pointer' }}
+    />
+  );
 }
 
-export function NotificationHeader({ count, total, allSelected, indeterminate, onToggleAll }: Props) {
+export function NotificationHeader({
+  count,
+  total,
+  allSelected,
+  indeterminate,
+  onToggleAll,
+}: Props) {
   return (
     <span style={{ display: 'inline-flex', alignItems: 'center', gap: 8 }}>
-      <Tag>{count}/{total}</Tag>
+      <Tag>
+        {count}/{total}
+      </Tag>
       <MasterCheckbox checked={allSelected} indeterminate={indeterminate} onChange={onToggleAll} />
     </span>
   );

Niektoré súbory nie sú zobrazené, pretože je v týchto rozdielových dátach zmenené mnoho súborov