chore(docs): update dependencies and adapt to zbsearch 4

fumadocs-core 16.14.5 switched its search engine from Orama to zbsearch 4, so the panel docs follow it up to the same major. zbsearch 4 still rejects locale codes as tokenizer languages ("en" throws, only "english" is accepted), so the custom search dialog that forces an English index stays necessary — verified by loading the built static index for all four locales and searching it through fumadocs' own client. Around that: - use `staticClient`, as `oramaStaticClient` is now a deprecated alias - drop @orama/orama, which nothing depends on or imports any more - correct the two comments that still described Orama and pointed at its docs and tokenizer package, one of them suggesting a language zbsearch does not have - restore the corepack integrity hash on `packageManager`, which CI reads through pnpm/action-setup - prune minimumReleaseAgeExclude entries for versions no longer installed The API reference MDX changes are serialization-only: fumadocs-openapi 11.2.4 emits plain scalars where it used folded ones. Parsed frontmatter and page bodies are unchanged.
2026-09-03 17:07:15 +00:00 · 2026-08-19 18:38:40 +02:00
parent ce63bf3e66
commit 3c087f6fd9
14 changed files with 934 additions and 1354 deletions
@@ -5,13 +5,8 @@ import { createFromSource } from 'fumadocs-core/search/server';
 export const revalidate = false;
 export const dynamic = 'force-static';
-// Static search index: works under both SSR/Vercel and static export
+// Every locale still serves English fallback content, so all map to zbsearch's
-// (`output: 'export'`). The client loads this prebuilt index and searches
+// English tokenizer (its SUPPORTED_LANGUAGES has no Persian or Chinese anyway).
 // in-browser (see the `type: 'static'` search option in app/[lang]/layout.tsx).
 // All locales currently hold English (fallback) content, and Orama has no
 // Persian tokenizer, so map every locale to the English tokenizer. When real
 // translations land, switch ru -> 'russian', zh -> 'mandarin' (with
 // @orama/tokenizers), etc. See https://docs.orama.com/open-source/supported-languages
 export const { staticGET: GET } = createFromSource(source, {
  localeMap: {
    en: 'english',
@@ -2,7 +2,7 @@
 import { create } from 'zbsearch';
 import { useDocsSearch } from 'fumadocs-core/search/client';
-import { oramaStaticClient } from 'fumadocs-core/search/client/orama-static';
+import { staticClient } from 'fumadocs-core/search/client/orama-static';
 import {
  SearchDialog,
  SearchDialogClose,
@@ -21,17 +21,13 @@ interface SharedProps {
  onOpenChange: (open: boolean) => void;
 }
-// The static search index is keyed by locale code (en/fa/ru/zh). Fumadocs'
+// Fumadocs' default dialog passes the index's locale code as a tokenizer language,
-// default static dialog feeds those codes to Orama as a tokenizer language, but
+// and zbsearch throws on anything but a full name — so force "english" everywhere.
 // Orama only accepts full names ("english") and throws on "en" — which silently
 // breaks search entirely. All docs content is English (other locales fall back
 // to it), so re-create the dialog — the documented escape hatch for custom search
 // setups — with an initDB that always builds an English index.
 export default function SearchDialogClient(props: SharedProps) {
  const { locale } = useI18n();
  const client = useMemo(
    () =>
-      oramaStaticClient({
+      staticClient({
        from: '/api/search',
        locale,
        initDB: () => create({ schema: { _: 'string' }, language: 'english' }),
@@ -1,8 +1,7 @@
 ---
 title: Authentication
-description: >-
+description: Two authentication modes are supported. UI sessions use a cookie
-  Two authentication modes are supported. UI sessions use a cookie set by the
+  set by the login endpoint. Programmatic clients (bots, scripts, remote panels)
  login endpoint. Programmatic clients (bots, scripts, remote panels)
  authenticate with a Bearer token taken from Settings → Security → API Token.
  Both work for every endpoint under /panel/api/*.
 full: true
@@ -11,51 +10,38 @@ _openapi:
    - ./public/openapi.json
  toc:
    - depth: 2
-      title: >-
+      title: Authenticate with username + password and receive a session cookie.
        Authenticate with username + password and receive a session cookie.
        Required before any cookie-based API call.
-      url: >-
+      url: '#authenticate-with-username--password-and-receive-a-session-cookie-required-before-any-cookie-based-api-call'
        #authenticate-with-username--password-and-receive-a-session-cookie-required-before-any-cookie-based-api-call
    - depth: 2
      title: Clear the session cookie. Requires the CSRF header for browser sessions.
      url: '#clear-the-session-cookie-requires-the-csrf-header-for-browser-sessions'
    - depth: 2
-      title: >-
+      title: Mint a CSRF token for the current session. The SPA replays it in the
        Mint a CSRF token for the current session. The SPA replays it in the
        X-CSRF-Token header on unsafe requests. Bearer-token callers can skip
        this — the middleware short-circuits CSRF for authenticated API
        requests.
-      url: >-
+      url: '#mint-a-csrf-token-for-the-current-session-the-spa-replays-it-in-the-x-csrf-token-header-on-unsafe-requests-bearer-token-callers-can-skip-this--the-middleware-short-circuits-csrf-for-authenticated-api-requests'
        #mint-a-csrf-token-for-the-current-session-the-spa-replays-it-in-the-x-csrf-token-header-on-unsafe-requests-bearer-token-callers-can-skip-this--the-middleware-short-circuits-csrf-for-authenticated-api-requests
    - depth: 2
-      title: >-
+      title: Returns whether 2FA is enabled on the panel — used by the login page to
        Returns whether 2FA is enabled on the panel — used by the login page to
        decide whether to show the OTP field.
-      url: >-
+      url: '#returns-whether-2fa-is-enabled-on-the-panel--used-by-the-login-page-to-decide-whether-to-show-the-otp-field'
        #returns-whether-2fa-is-enabled-on-the-panel--used-by-the-login-page-to-decide-whether-to-show-the-otp-field
  structuredData:
    headings:
-      - content: >-
+      - content: Authenticate with username + password and receive a session cookie.
          Authenticate with username + password and receive a session cookie.
          Required before any cookie-based API call.
-        id: >-
+        id: authenticate-with-username--password-and-receive-a-session-cookie-required-before-any-cookie-based-api-call
-          authenticate-with-username--password-and-receive-a-session-cookie-required-before-any-cookie-based-api-call
+      - content: Clear the session cookie. Requires the CSRF header for browser
      - content: >-
          Clear the session cookie. Requires the CSRF header for browser
          sessions.
        id: clear-the-session-cookie-requires-the-csrf-header-for-browser-sessions
-      - content: >-
+      - content: Mint a CSRF token for the current session. The SPA replays it in the
          Mint a CSRF token for the current session. The SPA replays it in the
          X-CSRF-Token header on unsafe requests. Bearer-token callers can skip
          this — the middleware short-circuits CSRF for authenticated API
          requests.
-        id: >-
+        id: mint-a-csrf-token-for-the-current-session-the-spa-replays-it-in-the-x-csrf-token-header-on-unsafe-requests-bearer-token-callers-can-skip-this--the-middleware-short-circuits-csrf-for-authenticated-api-requests
-          mint-a-csrf-token-for-the-current-session-the-spa-replays-it-in-the-x-csrf-token-header-on-unsafe-requests-bearer-token-callers-can-skip-this--the-middleware-short-circuits-csrf-for-authenticated-api-requests
+      - content: Returns whether 2FA is enabled on the panel — used by the login page to
-      - content: >-
+          decide whether to show the OTP field.
-          Returns whether 2FA is enabled on the panel — used by the login page
+        id: returns-whether-2fa-is-enabled-on-the-panel--used-by-the-login-page-to-decide-whether-to-show-the-otp-field
          to decide whether to show the OTP field.
        id: >-
          returns-whether-2fa-is-enabled-on-the-panel--used-by-the-login-page-to-decide-whether-to-show-the-otp-field
    contents: []
 ---
@@ -7,18 +7,14 @@ _openapi:
    - ./public/openapi.json
  toc:
    - depth: 2
-      title: >-
+      title: Send a fresh DB backup to every Telegram chat configured as an admin
        Send a fresh DB backup to every Telegram chat configured as an admin
        recipient. No body, no params.
-      url: >-
+      url: '#send-a-fresh-db-backup-to-every-telegram-chat-configured-as-an-admin-recipient-no-body-no-params'
        #send-a-fresh-db-backup-to-every-telegram-chat-configured-as-an-admin-recipient-no-body-no-params
  structuredData:
    headings:
-      - content: >-
+      - content: Send a fresh DB backup to every Telegram chat configured as an admin
          Send a fresh DB backup to every Telegram chat configured as an admin
          recipient. No body, no params.
-        id: >-
+        id: send-a-fresh-db-backup-to-every-telegram-chat-configured-as-an-admin-recipient-no-body-no-params
          send-a-fresh-db-backup-to-every-telegram-chat-configured-as-an-admin-recipient-no-body-no-params
    contents: []
 ---
@@ -1,195 +1,150 @@
 ---
 title: Clients
-description: >-
+description: Manage clients as first-class entities that can be attached to one
-  Manage clients as first-class entities that can be attached to one or more
+  or more inbounds. A single client row drives the settings.clients entry in
-  inbounds. A single client row drives the settings.clients entry in every
+  every inbound it belongs to. Endpoints live under /panel/api/clients.
  inbound it belongs to. Endpoints live under /panel/api/clients.
 full: true
 _openapi:
  preload:
    - ./public/openapi.json
  toc:
    - depth: 2
-      title: >-
+      title: List every client with its attached inbound IDs and traffic record. The
        List every client with its attached inbound IDs and traffic record. The
        reverse field, if set, is returned as a nested JSON object (legacy
        JSON-encoded-string form is still accepted on write).
-      url: >-
+      url: '#list-every-client-with-its-attached-inbound-ids-and-traffic-record-the-reverse-field-if-set-is-returned-as-a-nested-json-object-legacy-json-encoded-string-form-is-still-accepted-on-write'
        #list-every-client-with-its-attached-inbound-ids-and-traffic-record-the-reverse-field-if-set-is-returned-as-a-nested-json-object-legacy-json-encoded-string-form-is-still-accepted-on-write
    - depth: 2
-      title: >-
+      title: Filter, sort, and paginate clients on the server. Each item is a slim row
-        Filter, sort, and paginate clients on the server. Each item is a slim
+        (no uuid/password/auth/flow/security/reverse/tgId) so the clients page
-        row (no uuid/password/auth/flow/security/reverse/tgId) so the clients
+        can ship 25-ish rows in a few KB instead of the full table. The response
-        page can ship 25-ish rows in a few KB instead of the full table. The
+        also includes a summary computed across the full DB row set so dashboard
-        response also includes a summary computed across the full DB row set so
+        counters stay stable as the user paginates or filters. Page size capped
-        dashboard counters stay stable as the user paginates or filters. Page
+        at 200; fetch /get/:email to obtain the full per-client payload for an
-        size capped at 200; fetch /get/:email to obtain the full per-client
+        edit/info modal.
-        payload for an edit/info modal.
+      url: '#filter-sort-and-paginate-clients-on-the-server-each-item-is-a-slim-row-no-uuidpasswordauthflowsecurityreversetgid-so-the-clients-page-can-ship-25-ish-rows-in-a-few-kb-instead-of-the-full-table-the-response-also-includes-a-summary-computed-across-the-full-db-row-set-so-dashboard-counters-stay-stable-as-the-user-paginates-or-filters-page-size-capped-at-200-fetch-getemail-to-obtain-the-full-per-client-payload-for-an-editinfo-modal'
      url: >-
        #filter-sort-and-paginate-clients-on-the-server-each-item-is-a-slim-row-no-uuidpasswordauthflowsecurityreversetgid-so-the-clients-page-can-ship-25-ish-rows-in-a-few-kb-instead-of-the-full-table-the-response-also-includes-a-summary-computed-across-the-full-db-row-set-so-dashboard-counters-stay-stable-as-the-user-paginates-or-filters-page-size-capped-at-200-fetch-getemail-to-obtain-the-full-per-client-payload-for-an-editinfo-modal
    - depth: 2
-      title: >-
+      title: Fetch one client by email, including the inbound IDs and external config
        Fetch one client by email, including the inbound IDs and external config
        IDs it is attached to.
-      url: >-
+      url: '#fetch-one-client-by-email-including-the-inbound-ids-and-external-config-ids-it-is-attached-to'
        #fetch-one-client-by-email-including-the-inbound-ids-and-external-config-ids-it-is-attached-to
    - depth: 2
-      title: >-
+      title: Create a new client and attach it to one or more inbounds in a single
        Create a new client and attach it to one or more inbounds in a single
        call. Body is JSON. Per-protocol secrets (UUID for VLESS/VMess, password
        for Trojan/Shadowsocks, auth for Hysteria) are generated server-side
        when omitted, so callers can send only the universal fields.
-      url: >-
+      url: '#create-a-new-client-and-attach-it-to-one-or-more-inbounds-in-a-single-call-body-is-json-per-protocol-secrets-uuid-for-vlessvmess-password-for-trojanshadowsocks-auth-for-hysteria-are-generated-server-side-when-omitted-so-callers-can-send-only-the-universal-fields'
        #create-a-new-client-and-attach-it-to-one-or-more-inbounds-in-a-single-call-body-is-json-per-protocol-secrets-uuid-for-vlessvmess-password-for-trojanshadowsocks-auth-for-hysteria-are-generated-server-side-when-omitted-so-callers-can-send-only-the-universal-fields
    - depth: 2
-      title: >-
+      title: Update an existing client by email. Changes propagate to every attached
        Update an existing client by email. Changes propagate to every attached
        inbound. Body is the JSON client payload — supply the full set of fields
        you want to keep (the server replaces the row, it does not patch).
-      url: >-
+      url: '#update-an-existing-client-by-email-changes-propagate-to-every-attached-inbound-body-is-the-json-client-payload--supply-the-full-set-of-fields-you-want-to-keep-the-server-replaces-the-row-it-does-not-patch'
        #update-an-existing-client-by-email-changes-propagate-to-every-attached-inbound-body-is-the-json-client-payload--supply-the-full-set-of-fields-you-want-to-keep-the-server-replaces-the-row-it-does-not-patch
    - depth: 2
-      title: >-
+      title: Delete a client by email. Removes it from every attached inbound and
        Delete a client by email. Removes it from every attached inbound and
        drops its traffic record unless keepTraffic=1 is passed.
-      url: >-
+      url: '#delete-a-client-by-email-removes-it-from-every-attached-inbound-and-drops-its-traffic-record-unless-keeptraffic1-is-passed'
        #delete-a-client-by-email-removes-it-from-every-attached-inbound-and-drops-its-traffic-record-unless-keeptraffic1-is-passed
    - depth: 2
-      title: >-
+      title: Attach an existing client to one or more additional inbounds. Body is
        Attach an existing client to one or more additional inbounds. Body is
        JSON.
-      url: >-
+      url: '#attach-an-existing-client-to-one-or-more-additional-inbounds-body-is-json'
        #attach-an-existing-client-to-one-or-more-additional-inbounds-body-is-json
    - depth: 2
      title: Detach a client from one or more inbounds without deleting the client.
      url: '#detach-a-client-from-one-or-more-inbounds-without-deleting-the-client'
    - depth: 2
-      title: >-
+      title: Replace a client's external links (per-client share links and remote
        Replace a client's external links (per-client share links and remote
        subscription URLs surfaced in their subscription). Sends the full set;
        the server replaces all rows.
-      url: >-
+      url: '#replace-a-clients-external-links-per-client-share-links-and-remote-subscription-urls-surfaced-in-their-subscription-sends-the-full-set-the-server-replaces-all-rows'
        #replace-a-clients-external-links-per-client-share-links-and-remote-subscription-urls-surfaced-in-their-subscription-sends-the-full-set-the-server-replaces-all-rows
    - depth: 2
-      title: >-
+      title: Reset the up/down counters for every client globally. Quotas and expiry
        Reset the up/down counters for every client globally. Quotas and expiry
        are not affected. Triggers an Xray restart if any counter actually
        moved.
-      url: >-
+      url: '#reset-the-updown-counters-for-every-client-globally-quotas-and-expiry-are-not-affected-triggers-an-xray-restart-if-any-counter-actually-moved'
        #reset-the-updown-counters-for-every-client-globally-quotas-and-expiry-are-not-affected-triggers-an-xray-restart-if-any-counter-actually-moved
    - depth: 2
-      title: >-
+      title: Delete every client whose traffic quota is exhausted (used >= total, when
-        Delete every client whose traffic quota is exhausted (used >= total,
+        reset is disabled) or whose expiry has passed. Returns the deleted count
-        when reset is disabled) or whose expiry has passed. Returns the deleted
+        and triggers an Xray restart when any client was on a running inbound.
-        count and triggers an Xray restart when any client was on a running
+      url: '#delete-every-client-whose-traffic-quota-is-exhausted-used--total-when-reset-is-disabled-or-whose-expiry-has-passed-returns-the-deleted-count-and-triggers-an-xray-restart-when-any-client-was-on-a-running-inbound'
        inbound.
      url: >-
        #delete-every-client-whose-traffic-quota-is-exhausted-used--total-when-reset-is-disabled-or-whose-expiry-has-passed-returns-the-deleted-count-and-triggers-an-xray-restart-when-any-client-was-on-a-running-inbound
    - depth: 2
-      title: >-
+      title: Delete every client that is not attached to any inbound, along with its
        Delete every client that is not attached to any inbound, along with its
        traffic record, IP log, and external links. Useful for clearing clients
        left unattached after their inbounds were removed. Returns the deleted
        count. Cannot be undone.
-      url: >-
+      url: '#delete-every-client-that-is-not-attached-to-any-inbound-along-with-its-traffic-record-ip-log-and-external-links-useful-for-clearing-clients-left-unattached-after-their-inbounds-were-removed-returns-the-deleted-count-cannot-be-undone'
        #delete-every-client-that-is-not-attached-to-any-inbound-along-with-its-traffic-record-ip-log-and-external-links-useful-for-clearing-clients-left-unattached-after-their-inbounds-were-removed-returns-the-deleted-count-cannot-be-undone
    - depth: 2
-      title: >-
+      title: Return every client as a {client, inboundIds} array — the same shape
        Return every client as a {client, inboundIds} array — the same shape
        /bulkCreate and /import accept — so the payload round-trips straight
        back through /import. Clients with no inbound attachment are included
        with an empty inboundIds list. The UI shows this in a CodeMirror viewer
        (copy / download); programmatic callers get the array in obj.
-      url: >-
+      url: '#return-every-client-as-a-client-inboundids-array--the-same-shape-bulkcreate-and-import-accept--so-the-payload-round-trips-straight-back-through-import-clients-with-no-inbound-attachment-are-included-with-an-empty-inboundids-list-the-ui-shows-this-in-a-codemirror-viewer-copy--download-programmatic-callers-get-the-array-in-obj'
        #return-every-client-as-a-client-inboundids-array--the-same-shape-bulkcreate-and-import-accept--so-the-payload-round-trips-straight-back-through-import-clients-with-no-inbound-attachment-are-included-with-an-empty-inboundids-list-the-ui-shows-this-in-a-codemirror-viewer-copy--download-programmatic-callers-get-the-array-in-obj
    - depth: 2
-      title: >-
+      title: 'Import clients from a JSON body { "data": "<json>" }, where data is a
        Import clients from a JSON body { "data": "<json>" }, where data is a
        string-encoded array produced by /export ([{client, inboundIds}]). Items
        with inboundIds are created and attached to those inbounds; items with
        an empty inboundIds list are restored as unattached client records.
        Existing emails are never overwritten — they are returned in skipped.
        Triggers a single Xray restart at the end if any target inbound was
-        running.
+        running.'
-      url: >-
+      url: '#import-clients-from-a-json-body--data-json--where-data-is-a-string-encoded-array-produced-by-export-client-inboundids-items-with-inboundids-are-created-and-attached-to-those-inbounds-items-with-an-empty-inboundids-list-are-restored-as-unattached-client-records-existing-emails-are-never-overwritten--they-are-returned-in-skipped-triggers-a-single-xray-restart-at-the-end-if-any-target-inbound-was-running'
        #import-clients-from-a-json-body--data-json--where-data-is-a-string-encoded-array-produced-by-export-client-inboundids-items-with-inboundids-are-created-and-attached-to-those-inbounds-items-with-an-empty-inboundids-list-are-restored-as-unattached-client-records-existing-emails-are-never-overwritten--they-are-returned-in-skipped-triggers-a-single-xray-restart-at-the-end-if-any-target-inbound-was-running
    - depth: 2
-      title: >-
+      title: 'Shift expiry and/or traffic quota for many clients in one call.
        Shift expiry and/or traffic quota for many clients in one call.
        addDays/addBytes may be negative. Clients with unlimited expiry
        (expiryTime=0) or unlimited traffic (totalGB=0) are skipped for the
        corresponding field — bulk extend never converts unlimited to limited.
        The optional flow directive sets the XTLS flow on every client: "none"
        clears it, "xtls-rprx-vision"/"xtls-rprx-vision-udp443" set it where the
        inbound supports it (omit or "" to leave it unchanged). Returns the
-        adjusted count and per-email skip reasons.
+        adjusted count and per-email skip reasons.'
-      url: >-
+      url: '#shift-expiry-andor-traffic-quota-for-many-clients-in-one-call-adddaysaddbytes-may-be-negative-clients-with-unlimited-expiry-expirytime0-or-unlimited-traffic-totalgb0-are-skipped-for-the-corresponding-field--bulk-extend-never-converts-unlimited-to-limited-the-optional-flow-directive-sets-the-xtls-flow-on-every-client-none-clears-it-xtls-rprx-visionxtls-rprx-vision-udp443-set-it-where-the-inbound-supports-it-omit-or--to-leave-it-unchanged-returns-the-adjusted-count-and-per-email-skip-reasons'
        #shift-expiry-andor-traffic-quota-for-many-clients-in-one-call-adddaysaddbytes-may-be-negative-clients-with-unlimited-expiry-expirytime0-or-unlimited-traffic-totalgb0-are-skipped-for-the-corresponding-field--bulk-extend-never-converts-unlimited-to-limited-the-optional-flow-directive-sets-the-xtls-flow-on-every-client-none-clears-it-xtls-rprx-visionxtls-rprx-vision-udp443-set-it-where-the-inbound-supports-it-omit-or--to-leave-it-unchanged-returns-the-adjusted-count-and-per-email-skip-reasons
    - depth: 2
-      title: >-
+      title: Enable many clients in one call. Emails are grouped by inbound and
        Enable many clients in one call. Emails are grouped by inbound and
        applied with a single read-modify-write per inbound; the running Xray
        (local or remote node) is updated to add each user. Note that enabling a
        client whose quota is exhausted or whose expiry has passed only flips
        the flag — the traffic loop will disable it again on the next tick.
        Returns the changed count and per-email skip reasons.
-      url: >-
+      url: '#enable-many-clients-in-one-call-emails-are-grouped-by-inbound-and-applied-with-a-single-read-modify-write-per-inbound-the-running-xray-local-or-remote-node-is-updated-to-add-each-user-note-that-enabling-a-client-whose-quota-is-exhausted-or-whose-expiry-has-passed-only-flips-the-flag--the-traffic-loop-will-disable-it-again-on-the-next-tick-returns-the-changed-count-and-per-email-skip-reasons'
        #enable-many-clients-in-one-call-emails-are-grouped-by-inbound-and-applied-with-a-single-read-modify-write-per-inbound-the-running-xray-local-or-remote-node-is-updated-to-add-each-user-note-that-enabling-a-client-whose-quota-is-exhausted-or-whose-expiry-has-passed-only-flips-the-flag--the-traffic-loop-will-disable-it-again-on-the-next-tick-returns-the-changed-count-and-per-email-skip-reasons
    - depth: 2
-      title: >-
+      title: Disable many clients in one call. Emails are grouped by inbound and
        Disable many clients in one call. Emails are grouped by inbound and
        applied with a single read-modify-write per inbound; the running Xray
        (local or remote node) is updated to remove each user. Returns the
        changed count and per-email skip reasons.
-      url: >-
+      url: '#disable-many-clients-in-one-call-emails-are-grouped-by-inbound-and-applied-with-a-single-read-modify-write-per-inbound-the-running-xray-local-or-remote-node-is-updated-to-remove-each-user-returns-the-changed-count-and-per-email-skip-reasons'
        #disable-many-clients-in-one-call-emails-are-grouped-by-inbound-and-applied-with-a-single-read-modify-write-per-inbound-the-running-xray-local-or-remote-node-is-updated-to-remove-each-user-returns-the-changed-count-and-per-email-skip-reasons
    - depth: 2
-      title: >-
+      title: Delete many clients in one call. The server processes the list
        Delete many clients in one call. The server processes the list
        sequentially so each delete sees the committed state of the previous one
        — avoids the race the per-email fan-out had on the panel side. Pass
        keepTraffic=true to retain the xray_client_traffic rows after deletion.
-      url: >-
+      url: '#delete-many-clients-in-one-call-the-server-processes-the-list-sequentially-so-each-delete-sees-the-committed-state-of-the-previous-one--avoids-the-race-the-per-email-fan-out-had-on-the-panel-side-pass-keeptraffictrue-to-retain-the-xray_client_traffic-rows-after-deletion'
        #delete-many-clients-in-one-call-the-server-processes-the-list-sequentially-so-each-delete-sees-the-committed-state-of-the-previous-one--avoids-the-race-the-per-email-fan-out-had-on-the-panel-side-pass-keeptraffictrue-to-retain-the-xray_client_traffic-rows-after-deletion
    - depth: 2
-      title: >-
+      title: Create many clients in one call. Body is a JSON array of {client,
        Create many clients in one call. Body is a JSON array of {client,
        inboundIds} payloads — the same shape /add accepts. Items are processed
        sequentially; per-email skip reasons are returned for items that fail
        (e.g., duplicate email). Triggers a single Xray restart at the end if
        any inbound was running.
-      url: >-
+      url: '#create-many-clients-in-one-call-body-is-a-json-array-of-client-inboundids-payloads--the-same-shape-add-accepts-items-are-processed-sequentially-per-email-skip-reasons-are-returned-for-items-that-fail-eg-duplicate-email-triggers-a-single-xray-restart-at-the-end-if-any-inbound-was-running'
        #create-many-clients-in-one-call-body-is-a-json-array-of-client-inboundids-payloads--the-same-shape-add-accepts-items-are-processed-sequentially-per-email-skip-reasons-are-returned-for-items-that-fail-eg-duplicate-email-triggers-a-single-xray-restart-at-the-end-if-any-inbound-was-running
    - depth: 2
-      title: >-
+      title: Add many clients to a group in one call. Updates clients.group_name and
        Add many clients to a group in one call. Updates clients.group_name and
        patches the matching client entry inside every owning inbound's settings
        JSON in a single transaction. If the group name does not yet exist (in
        client_groups or as a derived label), it is auto-created as a persistent
        group. To clear the group label, use /groups/bulkRemove instead.
-      url: >-
+      url: '#add-many-clients-to-a-group-in-one-call-updates-clientsgroup_name-and-patches-the-matching-client-entry-inside-every-owning-inbounds-settings-json-in-a-single-transaction-if-the-group-name-does-not-yet-exist-in-client_groups-or-as-a-derived-label-it-is-auto-created-as-a-persistent-group-to-clear-the-group-label-use-groupsbulkremove-instead'
        #add-many-clients-to-a-group-in-one-call-updates-clientsgroup_name-and-patches-the-matching-client-entry-inside-every-owning-inbounds-settings-json-in-a-single-transaction-if-the-group-name-does-not-yet-exist-in-client_groups-or-as-a-derived-label-it-is-auto-created-as-a-persistent-group-to-clear-the-group-label-use-groupsbulkremove-instead
    - depth: 2
-      title: >-
+      title: Clear the group label on many clients in one call. Inverse of
        Clear the group label on many clients in one call. Inverse of
        /groups/bulkAdd. Clients themselves are kept — only the group label is
        cleared from clients.group_name and from each owning inbound's settings
        JSON. Groups become empty if all their members are removed.
-      url: >-
+      url: '#clear-the-group-label-on-many-clients-in-one-call-inverse-of-groupsbulkadd-clients-themselves-are-kept--only-the-group-label-is-cleared-from-clientsgroup_name-and-from-each-owning-inbounds-settings-json-groups-become-empty-if-all-their-members-are-removed'
        #clear-the-group-label-on-many-clients-in-one-call-inverse-of-groupsbulkadd-clients-themselves-are-kept--only-the-group-label-is-cleared-from-clientsgroup_name-and-from-each-owning-inbounds-settings-json-groups-become-empty-if-all-their-members-are-removed
    - depth: 2
-      title: >-
+      title: Attach many existing clients to many inbounds in one call. Each client
        Attach many existing clients to many inbounds in one call. Each client
        keeps its identity (email/UUID/password/subId) and a shared traffic row;
        all clients are added to a target inbound in a single AddInboundClient
        call. Clients already present on a target are reported under skipped.
        Returns per-email attached/skipped/errors lists and triggers a single
        Xray restart if any target inbound was running.
-      url: >-
+      url: '#attach-many-existing-clients-to-many-inbounds-in-one-call-each-client-keeps-its-identity-emailuuidpasswordsubid-and-a-shared-traffic-row-all-clients-are-added-to-a-target-inbound-in-a-single-addinboundclient-call-clients-already-present-on-a-target-are-reported-under-skipped-returns-per-email-attachedskippederrors-lists-and-triggers-a-single-xray-restart-if-any-target-inbound-was-running'
        #attach-many-existing-clients-to-many-inbounds-in-one-call-each-client-keeps-its-identity-emailuuidpasswordsubid-and-a-shared-traffic-row-all-clients-are-added-to-a-target-inbound-in-a-single-addinboundclient-call-clients-already-present-on-a-target-are-reported-under-skipped-returns-per-email-attachedskippederrors-lists-and-triggers-a-single-xray-restart-if-any-target-inbound-was-running
    - depth: 2
-      title: >-
+      title: "Mirror of bulkAttach: detach many existing clients from many inbounds in
        Mirror of bulkAttach: detach many existing clients from many inbounds in
        one call. For each email, intersects the client's current inbounds with
        the requested set and detaches from those only; (email, inbound) pairs
        where the client is not currently attached are silently no-ops. Emails
@@ -197,110 +152,82 @@ _openapi:
        skipped. Client records are kept even if they become orphaned — use
        bulkDel for full removal. Returns per-email detached/skipped/errors
        lists and triggers a single Xray restart if any target inbound was
-        running.
+        running."
-      url: >-
+      url: '#mirror-of-bulkattach-detach-many-existing-clients-from-many-inbounds-in-one-call-for-each-email-intersects-the-clients-current-inbounds-with-the-requested-set-and-detaches-from-those-only-email-inbound-pairs-where-the-client-is-not-currently-attached-are-silently-no-ops-emails-not-attached-to-any-of-the-requested-inbounds-are-reported-under-skipped-client-records-are-kept-even-if-they-become-orphaned--use-bulkdel-for-full-removal-returns-per-email-detachedskippederrors-lists-and-triggers-a-single-xray-restart-if-any-target-inbound-was-running'
        #mirror-of-bulkattach-detach-many-existing-clients-from-many-inbounds-in-one-call-for-each-email-intersects-the-clients-current-inbounds-with-the-requested-set-and-detaches-from-those-only-email-inbound-pairs-where-the-client-is-not-currently-attached-are-silently-no-ops-emails-not-attached-to-any-of-the-requested-inbounds-are-reported-under-skipped-client-records-are-kept-even-if-they-become-orphaned--use-bulkdel-for-full-removal-returns-per-email-detachedskippederrors-lists-and-triggers-a-single-xray-restart-if-any-target-inbound-was-running
    - depth: 2
-      title: >-
+      title: Zero up/down counters for many clients in one call. Loops the
        Zero up/down counters for many clients in one call. Loops the
        single-reset path so each client is re-enabled across its attached
        inbounds and pushed to Xray/remote nodes. Returns the count of
        successfully reset clients.
-      url: >-
+      url: '#zero-updown-counters-for-many-clients-in-one-call-loops-the-single-reset-path-so-each-client-is-re-enabled-across-its-attached-inbounds-and-pushed-to-xrayremote-nodes-returns-the-count-of-successfully-reset-clients'
        #zero-updown-counters-for-many-clients-in-one-call-loops-the-single-reset-path-so-each-client-is-re-enabled-across-its-attached-inbounds-and-pushed-to-xrayremote-nodes-returns-the-count-of-successfully-reset-clients
    - depth: 2
-      title: >-
+      title: List all client groups with their member counts. Merges persisted groups
        List all client groups with their member counts. Merges persisted groups
        (rows in client_groups, including empty placeholders) with the distinct
        group_name values currently set on clients. Sorted alphabetically
        (case-insensitive).
-      url: >-
+      url: '#list-all-client-groups-with-their-member-counts-merges-persisted-groups-rows-in-client_groups-including-empty-placeholders-with-the-distinct-group_name-values-currently-set-on-clients-sorted-alphabetically-case-insensitive'
        #list-all-client-groups-with-their-member-counts-merges-persisted-groups-rows-in-client_groups-including-empty-placeholders-with-the-distinct-group_name-values-currently-set-on-clients-sorted-alphabetically-case-insensitive
    - depth: 2
-      title: >-
+      title: Return just the email list of clients that currently belong to the given
        Return just the email list of clients that currently belong to the given
        group. Useful for fanning a single bulk action over an entire group
        without round-tripping the full client list.
-      url: >-
+      url: '#return-just-the-email-list-of-clients-that-currently-belong-to-the-given-group-useful-for-fanning-a-single-bulk-action-over-an-entire-group-without-round-tripping-the-full-client-list'
        #return-just-the-email-list-of-clients-that-currently-belong-to-the-given-group-useful-for-fanning-a-single-bulk-action-over-an-entire-group-without-round-tripping-the-full-client-list
    - depth: 2
-      title: >-
+      title: Create a new empty (placeholder) group. The group becomes selectable in
        Create a new empty (placeholder) group. The group becomes selectable in
        client forms and the filter drawer even before any client is added to
        it. Errors if a group with the same name already exists.
-      url: >-
+      url: '#create-a-new-empty-placeholder-group-the-group-becomes-selectable-in-client-forms-and-the-filter-drawer-even-before-any-client-is-added-to-it-errors-if-a-group-with-the-same-name-already-exists'
        #create-a-new-empty-placeholder-group-the-group-becomes-selectable-in-client-forms-and-the-filter-drawer-even-before-any-client-is-added-to-it-errors-if-a-group-with-the-same-name-already-exists
    - depth: 2
-      title: >-
+      title: Rename a group. The new name is applied to the client_groups row AND
        Rename a group. The new name is applied to the client_groups row AND
        propagated to every matching client (both clients.group_name and the
        client entry inside every owning inbound's settings JSON) in a single
        transaction. Returns the number of clients whose label was updated.
-      url: >-
+      url: '#rename-a-group-the-new-name-is-applied-to-the-client_groups-row-and-propagated-to-every-matching-client-both-clientsgroup_name-and-the-client-entry-inside-every-owning-inbounds-settings-json-in-a-single-transaction-returns-the-number-of-clients-whose-label-was-updated'
        #rename-a-group-the-new-name-is-applied-to-the-client_groups-row-and-propagated-to-every-matching-client-both-clientsgroup_name-and-the-client-entry-inside-every-owning-inbounds-settings-json-in-a-single-transaction-returns-the-number-of-clients-whose-label-was-updated
    - depth: 2
-      title: >-
+      title: Remove a group. Deletes the client_groups row and clears the group label
        Remove a group. Deletes the client_groups row and clears the group label
        from every matching client (both clients.group_name and the inbound
        settings JSON). The clients themselves are NOT deleted — use /bulkDel
        after filtering by group for that. Returns the count of clients whose
        label was cleared.
-      url: >-
+      url: '#remove-a-group-deletes-the-client_groups-row-and-clears-the-group-label-from-every-matching-client-both-clientsgroup_name-and-the-inbound-settings-json-the-clients-themselves-are-not-deleted--use-bulkdel-after-filtering-by-group-for-that-returns-the-count-of-clients-whose-label-was-cleared'
        #remove-a-group-deletes-the-client_groups-row-and-clears-the-group-label-from-every-matching-client-both-clientsgroup_name-and-the-inbound-settings-json-the-clients-themselves-are-not-deleted--use-bulkdel-after-filtering-by-group-for-that-returns-the-count-of-clients-whose-label-was-cleared
    - depth: 2
-      title: >-
+      title: Zero out a single client’s up/down counters. Re-enables the client across
-        Zero out a single client’s up/down counters. Re-enables the client
+        every attached inbound and pushes the change to Xray (or the remote
-        across every attached inbound and pushes the change to Xray (or the
+        node) so depleted users can connect again immediately.
-        remote node) so depleted users can connect again immediately.
+      url: '#zero-out-a-single-clients-updown-counters-re-enables-the-client-across-every-attached-inbound-and-pushes-the-change-to-xray-or-the-remote-node-so-depleted-users-can-connect-again-immediately'
      url: >-
        #zero-out-a-single-clients-updown-counters-re-enables-the-client-across-every-attached-inbound-and-pushes-the-change-to-xray-or-the-remote-node-so-depleted-users-can-connect-again-immediately
    - depth: 2
-      title: >-
+      title: Manually adjust a client’s upload + download counters. Useful for
        Manually adjust a client’s upload + download counters. Useful for
        migrations from external accounting systems.
-      url: >-
+      url: '#manually-adjust-a-clients-upload--download-counters-useful-for-migrations-from-external-accounting-systems'
        #manually-adjust-a-clients-upload--download-counters-useful-for-migrations-from-external-accounting-systems
    - depth: 2
-      title: >-
+      title: List source IPs that have connected with the given client’s credentials.
        List source IPs that have connected with the given client’s credentials.
        Returns an array of "ip (timestamp)" strings.
-      url: >-
+      url: '#list-source-ips-that-have-connected-with-the-given-clients-credentials-returns-an-array-of-ip-timestamp-strings'
        #list-source-ips-that-have-connected-with-the-given-clients-credentials-returns-an-array-of-ip-timestamp-strings
    - depth: 2
      title: Reset the recorded IP list for a client.
      url: '#reset-the-recorded-ip-list-for-a-client'
    - depth: 2
-      title: >-
+      title: List the emails of currently connected clients (last seen within the
        List the emails of currently connected clients (last seen within the
        heartbeat window), deduped across every node.
-      url: >-
+      url: '#list-the-emails-of-currently-connected-clients-last-seen-within-the-heartbeat-window-deduped-across-every-node'
        #list-the-emails-of-currently-connected-clients-last-seen-within-the-heartbeat-window-deduped-across-every-node
    - depth: 2
-      title: >-
+      title: Online client emails grouped by the panelGuid of the node that physically
-        Online client emails grouped by the panelGuid of the node that
+        hosts each client. The local panel uses its own GUID; each node (at any
-        physically hosts each client. The local panel uses its own GUID; each
+        depth in a chain) uses its GUID. Lets the inbounds page attribute online
-        node (at any depth in a chain) uses its GUID. Lets the inbounds page
+        status to the real node instead of the intermediate one it syncs
-        attribute online status to the real node instead of the intermediate one
+        through.
-        it syncs through.
+      url: '#online-client-emails-grouped-by-the-panelguid-of-the-node-that-physically-hosts-each-client-the-local-panel-uses-its-own-guid-each-node-at-any-depth-in-a-chain-uses-its-guid-lets-the-inbounds-page-attribute-online-status-to-the-real-node-instead-of-the-intermediate-one-it-syncs-through'
      url: >-
        #online-client-emails-grouped-by-the-panelguid-of-the-node-that-physically-hosts-each-client-the-local-panel-uses-its-own-guid-each-node-at-any-depth-in-a-chain-uses-its-guid-lets-the-inbounds-page-attribute-online-status-to-the-real-node-instead-of-the-intermediate-one-it-syncs-through
    - depth: 2
-      title: >-
+      title: Per-client source IPs grouped by the panelGuid of the node that observed
        Per-client source IPs grouped by the panelGuid of the node that observed
        them. Lets the central panel attribute and enforce per-client IP limits
        using the real visitor IPs each node sees, instead of the address of the
        intermediate panel it syncs through.
-      url: >-
+      url: '#per-client-source-ips-grouped-by-the-panelguid-of-the-node-that-observed-them-lets-the-central-panel-attribute-and-enforce-per-client-ip-limits-using-the-real-visitor-ips-each-node-sees-instead-of-the-address-of-the-intermediate-panel-it-syncs-through'
        #per-client-source-ips-grouped-by-the-panelguid-of-the-node-that-observed-them-lets-the-central-panel-attribute-and-enforce-per-client-ip-limits-using-the-real-visitor-ips-each-node-sees-instead-of-the-address-of-the-intermediate-panel-it-syncs-through
    - depth: 2
-      title: >-
+      title: Inbound tags that carried traffic within the heartbeat window, grouped by
-        Inbound tags that carried traffic within the heartbeat window, grouped
+        the hosting node's panelGuid. Pairs with onlinesByGuid so the inbounds
-        by the hosting node's panelGuid. Pairs with onlinesByGuid so the
+        page only marks a multi-inbound client online on the inbounds it
-        inbounds page only marks a multi-inbound client online on the inbounds
+        actually used. Nodes that do not report per-inbound activity are absent.
-        it actually used. Nodes that do not report per-inbound activity are
+      url: '#inbound-tags-that-carried-traffic-within-the-heartbeat-window-grouped-by-the-hosting-nodes-panelguid-pairs-with-onlinesbyguid-so-the-inbounds-page-only-marks-a-multi-inbound-client-online-on-the-inbounds-it-actually-used-nodes-that-do-not-report-per-inbound-activity-are-absent'
        absent.
      url: >-
        #inbound-tags-that-carried-traffic-within-the-heartbeat-window-grouped-by-the-hosting-nodes-panelguid-pairs-with-onlinesbyguid-so-the-inbounds-page-only-marks-a-multi-inbound-client-online-on-the-inbounds-it-actually-used-nodes-that-do-not-report-per-inbound-activity-are-absent
    - depth: 2
      title: Map of client email → last-seen unix timestamp.
      url: '#map-of-client-email--last-seen-unix-timestamp'
@@ -308,189 +235,142 @@ _openapi:
      title: Traffic counters for a client identified by email.
      url: '#traffic-counters-for-a-client-identified-by-email'
    - depth: 2
-      title: >-
+      title: Return every protocol URL (vless://, vmess://, trojan://, ss://,
        Return every protocol URL (vless://, vmess://, trojan://, ss://,
        hysteria://, hy2://) for clients matching the subscription ID. Same
        result set as /sub/<subId>, but as a JSON array — no base64. When an
        inbound has streamSettings.externalProxy set, one URL is emitted per
        external proxy. Empty array when the subId has no enabled clients.
-      url: >-
+      url: '#return-every-protocol-url-vless-vmess-trojan-ss-hysteria-hy2-for-clients-matching-the-subscription-id-same-result-set-as-subsubid-but-as-a-json-array--no-base64-when-an-inbound-has-streamsettingsexternalproxy-set-one-url-is-emitted-per-external-proxy-empty-array-when-the-subid-has-no-enabled-clients'
        #return-every-protocol-url-vless-vmess-trojan-ss-hysteria-hy2-for-clients-matching-the-subscription-id-same-result-set-as-subsubid-but-as-a-json-array--no-base64-when-an-inbound-has-streamsettingsexternalproxy-set-one-url-is-emitted-per-external-proxy-empty-array-when-the-subid-has-no-enabled-clients
    - depth: 2
-      title: >-
+      title: 'Return every URL for one client across all attached inbounds — the same
        Return every URL for one client across all attached inbounds — the same
        strings the Copy URL button copies in the panel UI. Supported protocols:
        vmess, vless, trojan, shadowsocks, hysteria. If
        streamSettings.externalProxy is set, returns one URL per external proxy.
        Protocols without a URL form (socks, http, mixed, wireguard, dokodemo,
-        tunnel) contribute nothing.
+        tunnel) contribute nothing.'
-      url: >-
+      url: '#return-every-url-for-one-client-across-all-attached-inbounds--the-same-strings-the-copy-url-button-copies-in-the-panel-ui-supported-protocols-vmess-vless-trojan-shadowsocks-hysteria-if-streamsettingsexternalproxy-is-set-returns-one-url-per-external-proxy-protocols-without-a-url-form-socks-http-mixed-wireguard-dokodemo-tunnel-contribute-nothing'
        #return-every-url-for-one-client-across-all-attached-inbounds--the-same-strings-the-copy-url-button-copies-in-the-panel-ui-supported-protocols-vmess-vless-trojan-shadowsocks-hysteria-if-streamsettingsexternalproxy-is-set-returns-one-url-per-external-proxy-protocols-without-a-url-form-socks-http-mixed-wireguard-dokodemo-tunnel-contribute-nothing
  structuredData:
    headings:
-      - content: >-
+      - content: List every client with its attached inbound IDs and traffic record. The
-          List every client with its attached inbound IDs and traffic record.
+          reverse field, if set, is returned as a nested JSON object (legacy
          The reverse field, if set, is returned as a nested JSON object (legacy
          JSON-encoded-string form is still accepted on write).
-        id: >-
+        id: list-every-client-with-its-attached-inbound-ids-and-traffic-record-the-reverse-field-if-set-is-returned-as-a-nested-json-object-legacy-json-encoded-string-form-is-still-accepted-on-write
-          list-every-client-with-its-attached-inbound-ids-and-traffic-record-the-reverse-field-if-set-is-returned-as-a-nested-json-object-legacy-json-encoded-string-form-is-still-accepted-on-write
+      - content: Filter, sort, and paginate clients on the server. Each item is a slim
      - content: >-
          Filter, sort, and paginate clients on the server. Each item is a slim
          row (no uuid/password/auth/flow/security/reverse/tgId) so the clients
          page can ship 25-ish rows in a few KB instead of the full table. The
          response also includes a summary computed across the full DB row set
          so dashboard counters stay stable as the user paginates or filters.
          Page size capped at 200; fetch /get/:email to obtain the full
          per-client payload for an edit/info modal.
-        id: >-
+        id: filter-sort-and-paginate-clients-on-the-server-each-item-is-a-slim-row-no-uuidpasswordauthflowsecurityreversetgid-so-the-clients-page-can-ship-25-ish-rows-in-a-few-kb-instead-of-the-full-table-the-response-also-includes-a-summary-computed-across-the-full-db-row-set-so-dashboard-counters-stay-stable-as-the-user-paginates-or-filters-page-size-capped-at-200-fetch-getemail-to-obtain-the-full-per-client-payload-for-an-editinfo-modal
-          filter-sort-and-paginate-clients-on-the-server-each-item-is-a-slim-row-no-uuidpasswordauthflowsecurityreversetgid-so-the-clients-page-can-ship-25-ish-rows-in-a-few-kb-instead-of-the-full-table-the-response-also-includes-a-summary-computed-across-the-full-db-row-set-so-dashboard-counters-stay-stable-as-the-user-paginates-or-filters-page-size-capped-at-200-fetch-getemail-to-obtain-the-full-per-client-payload-for-an-editinfo-modal
+      - content: Fetch one client by email, including the inbound IDs and external
      - content: >-
          Fetch one client by email, including the inbound IDs and external
          config IDs it is attached to.
-        id: >-
+        id: fetch-one-client-by-email-including-the-inbound-ids-and-external-config-ids-it-is-attached-to
-          fetch-one-client-by-email-including-the-inbound-ids-and-external-config-ids-it-is-attached-to
+      - content: Create a new client and attach it to one or more inbounds in a single
      - content: >-
          Create a new client and attach it to one or more inbounds in a single
          call. Body is JSON. Per-protocol secrets (UUID for VLESS/VMess,
          password for Trojan/Shadowsocks, auth for Hysteria) are generated
          server-side when omitted, so callers can send only the universal
          fields.
-        id: >-
+        id: create-a-new-client-and-attach-it-to-one-or-more-inbounds-in-a-single-call-body-is-json-per-protocol-secrets-uuid-for-vlessvmess-password-for-trojanshadowsocks-auth-for-hysteria-are-generated-server-side-when-omitted-so-callers-can-send-only-the-universal-fields
-          create-a-new-client-and-attach-it-to-one-or-more-inbounds-in-a-single-call-body-is-json-per-protocol-secrets-uuid-for-vlessvmess-password-for-trojanshadowsocks-auth-for-hysteria-are-generated-server-side-when-omitted-so-callers-can-send-only-the-universal-fields
+      - content: Update an existing client by email. Changes propagate to every attached
-      - content: >-
+          inbound. Body is the JSON client payload — supply the full set of
-          Update an existing client by email. Changes propagate to every
+          fields you want to keep (the server replaces the row, it does not
-          attached inbound. Body is the JSON client payload — supply the full
+          patch).
-          set of fields you want to keep (the server replaces the row, it does
+        id: update-an-existing-client-by-email-changes-propagate-to-every-attached-inbound-body-is-the-json-client-payload--supply-the-full-set-of-fields-you-want-to-keep-the-server-replaces-the-row-it-does-not-patch
-          not patch).
+      - content: Delete a client by email. Removes it from every attached inbound and
        id: >-
          update-an-existing-client-by-email-changes-propagate-to-every-attached-inbound-body-is-the-json-client-payload--supply-the-full-set-of-fields-you-want-to-keep-the-server-replaces-the-row-it-does-not-patch
      - content: >-
          Delete a client by email. Removes it from every attached inbound and
          drops its traffic record unless keepTraffic=1 is passed.
-        id: >-
+        id: delete-a-client-by-email-removes-it-from-every-attached-inbound-and-drops-its-traffic-record-unless-keeptraffic1-is-passed
-          delete-a-client-by-email-removes-it-from-every-attached-inbound-and-drops-its-traffic-record-unless-keeptraffic1-is-passed
+      - content: Attach an existing client to one or more additional inbounds. Body is
      - content: >-
          Attach an existing client to one or more additional inbounds. Body is
          JSON.
-        id: >-
+        id: attach-an-existing-client-to-one-or-more-additional-inbounds-body-is-json
          attach-an-existing-client-to-one-or-more-additional-inbounds-body-is-json
      - content: Detach a client from one or more inbounds without deleting the client.
        id: detach-a-client-from-one-or-more-inbounds-without-deleting-the-client
-      - content: >-
+      - content: Replace a client's external links (per-client share links and remote
          Replace a client's external links (per-client share links and remote
          subscription URLs surfaced in their subscription). Sends the full set;
          the server replaces all rows.
-        id: >-
+        id: replace-a-clients-external-links-per-client-share-links-and-remote-subscription-urls-surfaced-in-their-subscription-sends-the-full-set-the-server-replaces-all-rows
-          replace-a-clients-external-links-per-client-share-links-and-remote-subscription-urls-surfaced-in-their-subscription-sends-the-full-set-the-server-replaces-all-rows
+      - content: Reset the up/down counters for every client globally. Quotas and expiry
-      - content: >-
+          are not affected. Triggers an Xray restart if any counter actually
-          Reset the up/down counters for every client globally. Quotas and
+          moved.
-          expiry are not affected. Triggers an Xray restart if any counter
+        id: reset-the-updown-counters-for-every-client-globally-quotas-and-expiry-are-not-affected-triggers-an-xray-restart-if-any-counter-actually-moved
-          actually moved.
+      - content: Delete every client whose traffic quota is exhausted (used >= total,
        id: >-
          reset-the-updown-counters-for-every-client-globally-quotas-and-expiry-are-not-affected-triggers-an-xray-restart-if-any-counter-actually-moved
      - content: >-
          Delete every client whose traffic quota is exhausted (used >= total,
          when reset is disabled) or whose expiry has passed. Returns the
          deleted count and triggers an Xray restart when any client was on a
          running inbound.
-        id: >-
+        id: delete-every-client-whose-traffic-quota-is-exhausted-used--total-when-reset-is-disabled-or-whose-expiry-has-passed-returns-the-deleted-count-and-triggers-an-xray-restart-when-any-client-was-on-a-running-inbound
-          delete-every-client-whose-traffic-quota-is-exhausted-used--total-when-reset-is-disabled-or-whose-expiry-has-passed-returns-the-deleted-count-and-triggers-an-xray-restart-when-any-client-was-on-a-running-inbound
+      - content: Delete every client that is not attached to any inbound, along with its
-      - content: >-
+          traffic record, IP log, and external links. Useful for clearing
          Delete every client that is not attached to any inbound, along with
          its traffic record, IP log, and external links. Useful for clearing
          clients left unattached after their inbounds were removed. Returns the
          deleted count. Cannot be undone.
-        id: >-
+        id: delete-every-client-that-is-not-attached-to-any-inbound-along-with-its-traffic-record-ip-log-and-external-links-useful-for-clearing-clients-left-unattached-after-their-inbounds-were-removed-returns-the-deleted-count-cannot-be-undone
-          delete-every-client-that-is-not-attached-to-any-inbound-along-with-its-traffic-record-ip-log-and-external-links-useful-for-clearing-clients-left-unattached-after-their-inbounds-were-removed-returns-the-deleted-count-cannot-be-undone
+      - content: Return every client as a {client, inboundIds} array — the same shape
      - content: >-
          Return every client as a {client, inboundIds} array — the same shape
          /bulkCreate and /import accept — so the payload round-trips straight
          back through /import. Clients with no inbound attachment are included
          with an empty inboundIds list. The UI shows this in a CodeMirror
          viewer (copy / download); programmatic callers get the array in obj.
-        id: >-
+        id: return-every-client-as-a-client-inboundids-array--the-same-shape-bulkcreate-and-import-accept--so-the-payload-round-trips-straight-back-through-import-clients-with-no-inbound-attachment-are-included-with-an-empty-inboundids-list-the-ui-shows-this-in-a-codemirror-viewer-copy--download-programmatic-callers-get-the-array-in-obj
-          return-every-client-as-a-client-inboundids-array--the-same-shape-bulkcreate-and-import-accept--so-the-payload-round-trips-straight-back-through-import-clients-with-no-inbound-attachment-are-included-with-an-empty-inboundids-list-the-ui-shows-this-in-a-codemirror-viewer-copy--download-programmatic-callers-get-the-array-in-obj
+      - content: 'Import clients from a JSON body { "data": "<json>" }, where data is a
      - content: >-
          Import clients from a JSON body { "data": "<json>" }, where data is a
          string-encoded array produced by /export ([{client, inboundIds}]).
          Items with inboundIds are created and attached to those inbounds;
          items with an empty inboundIds list are restored as unattached client
          records. Existing emails are never overwritten — they are returned in
          skipped. Triggers a single Xray restart at the end if any target
-          inbound was running.
+          inbound was running.'
-        id: >-
+        id: import-clients-from-a-json-body--data-json--where-data-is-a-string-encoded-array-produced-by-export-client-inboundids-items-with-inboundids-are-created-and-attached-to-those-inbounds-items-with-an-empty-inboundids-list-are-restored-as-unattached-client-records-existing-emails-are-never-overwritten--they-are-returned-in-skipped-triggers-a-single-xray-restart-at-the-end-if-any-target-inbound-was-running
-          import-clients-from-a-json-body--data-json--where-data-is-a-string-encoded-array-produced-by-export-client-inboundids-items-with-inboundids-are-created-and-attached-to-those-inbounds-items-with-an-empty-inboundids-list-are-restored-as-unattached-client-records-existing-emails-are-never-overwritten--they-are-returned-in-skipped-triggers-a-single-xray-restart-at-the-end-if-any-target-inbound-was-running
+      - content: 'Shift expiry and/or traffic quota for many clients in one call.
      - content: >-
          Shift expiry and/or traffic quota for many clients in one call.
          addDays/addBytes may be negative. Clients with unlimited expiry
          (expiryTime=0) or unlimited traffic (totalGB=0) are skipped for the
          corresponding field — bulk extend never converts unlimited to limited.
          The optional flow directive sets the XTLS flow on every client: "none"
          clears it, "xtls-rprx-vision"/"xtls-rprx-vision-udp443" set it where
          the inbound supports it (omit or "" to leave it unchanged). Returns
-          the adjusted count and per-email skip reasons.
+          the adjusted count and per-email skip reasons.'
-        id: >-
+        id: shift-expiry-andor-traffic-quota-for-many-clients-in-one-call-adddaysaddbytes-may-be-negative-clients-with-unlimited-expiry-expirytime0-or-unlimited-traffic-totalgb0-are-skipped-for-the-corresponding-field--bulk-extend-never-converts-unlimited-to-limited-the-optional-flow-directive-sets-the-xtls-flow-on-every-client-none-clears-it-xtls-rprx-visionxtls-rprx-vision-udp443-set-it-where-the-inbound-supports-it-omit-or--to-leave-it-unchanged-returns-the-adjusted-count-and-per-email-skip-reasons
-          shift-expiry-andor-traffic-quota-for-many-clients-in-one-call-adddaysaddbytes-may-be-negative-clients-with-unlimited-expiry-expirytime0-or-unlimited-traffic-totalgb0-are-skipped-for-the-corresponding-field--bulk-extend-never-converts-unlimited-to-limited-the-optional-flow-directive-sets-the-xtls-flow-on-every-client-none-clears-it-xtls-rprx-visionxtls-rprx-vision-udp443-set-it-where-the-inbound-supports-it-omit-or--to-leave-it-unchanged-returns-the-adjusted-count-and-per-email-skip-reasons
+      - content: Enable many clients in one call. Emails are grouped by inbound and
      - content: >-
          Enable many clients in one call. Emails are grouped by inbound and
          applied with a single read-modify-write per inbound; the running Xray
          (local or remote node) is updated to add each user. Note that enabling
          a client whose quota is exhausted or whose expiry has passed only
          flips the flag — the traffic loop will disable it again on the next
          tick. Returns the changed count and per-email skip reasons.
-        id: >-
+        id: enable-many-clients-in-one-call-emails-are-grouped-by-inbound-and-applied-with-a-single-read-modify-write-per-inbound-the-running-xray-local-or-remote-node-is-updated-to-add-each-user-note-that-enabling-a-client-whose-quota-is-exhausted-or-whose-expiry-has-passed-only-flips-the-flag--the-traffic-loop-will-disable-it-again-on-the-next-tick-returns-the-changed-count-and-per-email-skip-reasons
-          enable-many-clients-in-one-call-emails-are-grouped-by-inbound-and-applied-with-a-single-read-modify-write-per-inbound-the-running-xray-local-or-remote-node-is-updated-to-add-each-user-note-that-enabling-a-client-whose-quota-is-exhausted-or-whose-expiry-has-passed-only-flips-the-flag--the-traffic-loop-will-disable-it-again-on-the-next-tick-returns-the-changed-count-and-per-email-skip-reasons
+      - content: Disable many clients in one call. Emails are grouped by inbound and
      - content: >-
          Disable many clients in one call. Emails are grouped by inbound and
          applied with a single read-modify-write per inbound; the running Xray
          (local or remote node) is updated to remove each user. Returns the
          changed count and per-email skip reasons.
-        id: >-
+        id: disable-many-clients-in-one-call-emails-are-grouped-by-inbound-and-applied-with-a-single-read-modify-write-per-inbound-the-running-xray-local-or-remote-node-is-updated-to-remove-each-user-returns-the-changed-count-and-per-email-skip-reasons
-          disable-many-clients-in-one-call-emails-are-grouped-by-inbound-and-applied-with-a-single-read-modify-write-per-inbound-the-running-xray-local-or-remote-node-is-updated-to-remove-each-user-returns-the-changed-count-and-per-email-skip-reasons
+      - content: Delete many clients in one call. The server processes the list
      - content: >-
          Delete many clients in one call. The server processes the list
          sequentially so each delete sees the committed state of the previous
          one — avoids the race the per-email fan-out had on the panel side.
          Pass keepTraffic=true to retain the xray_client_traffic rows after
          deletion.
-        id: >-
+        id: delete-many-clients-in-one-call-the-server-processes-the-list-sequentially-so-each-delete-sees-the-committed-state-of-the-previous-one--avoids-the-race-the-per-email-fan-out-had-on-the-panel-side-pass-keeptraffictrue-to-retain-the-xray_client_traffic-rows-after-deletion
-          delete-many-clients-in-one-call-the-server-processes-the-list-sequentially-so-each-delete-sees-the-committed-state-of-the-previous-one--avoids-the-race-the-per-email-fan-out-had-on-the-panel-side-pass-keeptraffictrue-to-retain-the-xray_client_traffic-rows-after-deletion
+      - content: Create many clients in one call. Body is a JSON array of {client,
      - content: >-
          Create many clients in one call. Body is a JSON array of {client,
          inboundIds} payloads — the same shape /add accepts. Items are
          processed sequentially; per-email skip reasons are returned for items
          that fail (e.g., duplicate email). Triggers a single Xray restart at
          the end if any inbound was running.
-        id: >-
+        id: create-many-clients-in-one-call-body-is-a-json-array-of-client-inboundids-payloads--the-same-shape-add-accepts-items-are-processed-sequentially-per-email-skip-reasons-are-returned-for-items-that-fail-eg-duplicate-email-triggers-a-single-xray-restart-at-the-end-if-any-inbound-was-running
-          create-many-clients-in-one-call-body-is-a-json-array-of-client-inboundids-payloads--the-same-shape-add-accepts-items-are-processed-sequentially-per-email-skip-reasons-are-returned-for-items-that-fail-eg-duplicate-email-triggers-a-single-xray-restart-at-the-end-if-any-inbound-was-running
+      - content: Add many clients to a group in one call. Updates clients.group_name and
-      - content: >-
+          patches the matching client entry inside every owning inbound's
          Add many clients to a group in one call. Updates clients.group_name
          and patches the matching client entry inside every owning inbound's
          settings JSON in a single transaction. If the group name does not yet
          exist (in client_groups or as a derived label), it is auto-created as
          a persistent group. To clear the group label, use /groups/bulkRemove
          instead.
-        id: >-
+        id: add-many-clients-to-a-group-in-one-call-updates-clientsgroup_name-and-patches-the-matching-client-entry-inside-every-owning-inbounds-settings-json-in-a-single-transaction-if-the-group-name-does-not-yet-exist-in-client_groups-or-as-a-derived-label-it-is-auto-created-as-a-persistent-group-to-clear-the-group-label-use-groupsbulkremove-instead
-          add-many-clients-to-a-group-in-one-call-updates-clientsgroup_name-and-patches-the-matching-client-entry-inside-every-owning-inbounds-settings-json-in-a-single-transaction-if-the-group-name-does-not-yet-exist-in-client_groups-or-as-a-derived-label-it-is-auto-created-as-a-persistent-group-to-clear-the-group-label-use-groupsbulkremove-instead
+      - content: Clear the group label on many clients in one call. Inverse of
      - content: >-
          Clear the group label on many clients in one call. Inverse of
          /groups/bulkAdd. Clients themselves are kept — only the group label is
          cleared from clients.group_name and from each owning inbound's
          settings JSON. Groups become empty if all their members are removed.
-        id: >-
+        id: clear-the-group-label-on-many-clients-in-one-call-inverse-of-groupsbulkadd-clients-themselves-are-kept--only-the-group-label-is-cleared-from-clientsgroup_name-and-from-each-owning-inbounds-settings-json-groups-become-empty-if-all-their-members-are-removed
-          clear-the-group-label-on-many-clients-in-one-call-inverse-of-groupsbulkadd-clients-themselves-are-kept--only-the-group-label-is-cleared-from-clientsgroup_name-and-from-each-owning-inbounds-settings-json-groups-become-empty-if-all-their-members-are-removed
+      - content: Attach many existing clients to many inbounds in one call. Each client
      - content: >-
          Attach many existing clients to many inbounds in one call. Each client
          keeps its identity (email/UUID/password/subId) and a shared traffic
          row; all clients are added to a target inbound in a single
          AddInboundClient call. Clients already present on a target are
          reported under skipped. Returns per-email attached/skipped/errors
          lists and triggers a single Xray restart if any target inbound was
          running.
-        id: >-
+        id: attach-many-existing-clients-to-many-inbounds-in-one-call-each-client-keeps-its-identity-emailuuidpasswordsubid-and-a-shared-traffic-row-all-clients-are-added-to-a-target-inbound-in-a-single-addinboundclient-call-clients-already-present-on-a-target-are-reported-under-skipped-returns-per-email-attachedskippederrors-lists-and-triggers-a-single-xray-restart-if-any-target-inbound-was-running
-          attach-many-existing-clients-to-many-inbounds-in-one-call-each-client-keeps-its-identity-emailuuidpasswordsubid-and-a-shared-traffic-row-all-clients-are-added-to-a-target-inbound-in-a-single-addinboundclient-call-clients-already-present-on-a-target-are-reported-under-skipped-returns-per-email-attachedskippederrors-lists-and-triggers-a-single-xray-restart-if-any-target-inbound-was-running
+      - content: "Mirror of bulkAttach: detach many existing clients from many inbounds
      - content: >-
          Mirror of bulkAttach: detach many existing clients from many inbounds
          in one call. For each email, intersects the client's current inbounds
          with the requested set and detaches from those only; (email, inbound)
          pairs where the client is not currently attached are silently no-ops.
@@ -498,117 +378,86 @@ _openapi:
          under skipped. Client records are kept even if they become orphaned —
          use bulkDel for full removal. Returns per-email
          detached/skipped/errors lists and triggers a single Xray restart if
-          any target inbound was running.
+          any target inbound was running."
-        id: >-
+        id: mirror-of-bulkattach-detach-many-existing-clients-from-many-inbounds-in-one-call-for-each-email-intersects-the-clients-current-inbounds-with-the-requested-set-and-detaches-from-those-only-email-inbound-pairs-where-the-client-is-not-currently-attached-are-silently-no-ops-emails-not-attached-to-any-of-the-requested-inbounds-are-reported-under-skipped-client-records-are-kept-even-if-they-become-orphaned--use-bulkdel-for-full-removal-returns-per-email-detachedskippederrors-lists-and-triggers-a-single-xray-restart-if-any-target-inbound-was-running
-          mirror-of-bulkattach-detach-many-existing-clients-from-many-inbounds-in-one-call-for-each-email-intersects-the-clients-current-inbounds-with-the-requested-set-and-detaches-from-those-only-email-inbound-pairs-where-the-client-is-not-currently-attached-are-silently-no-ops-emails-not-attached-to-any-of-the-requested-inbounds-are-reported-under-skipped-client-records-are-kept-even-if-they-become-orphaned--use-bulkdel-for-full-removal-returns-per-email-detachedskippederrors-lists-and-triggers-a-single-xray-restart-if-any-target-inbound-was-running
+      - content: Zero up/down counters for many clients in one call. Loops the
      - content: >-
          Zero up/down counters for many clients in one call. Loops the
          single-reset path so each client is re-enabled across its attached
          inbounds and pushed to Xray/remote nodes. Returns the count of
          successfully reset clients.
-        id: >-
+        id: zero-updown-counters-for-many-clients-in-one-call-loops-the-single-reset-path-so-each-client-is-re-enabled-across-its-attached-inbounds-and-pushed-to-xrayremote-nodes-returns-the-count-of-successfully-reset-clients
-          zero-updown-counters-for-many-clients-in-one-call-loops-the-single-reset-path-so-each-client-is-re-enabled-across-its-attached-inbounds-and-pushed-to-xrayremote-nodes-returns-the-count-of-successfully-reset-clients
+      - content: List all client groups with their member counts. Merges persisted
      - content: >-
          List all client groups with their member counts. Merges persisted
          groups (rows in client_groups, including empty placeholders) with the
          distinct group_name values currently set on clients. Sorted
          alphabetically (case-insensitive).
-        id: >-
+        id: list-all-client-groups-with-their-member-counts-merges-persisted-groups-rows-in-client_groups-including-empty-placeholders-with-the-distinct-group_name-values-currently-set-on-clients-sorted-alphabetically-case-insensitive
-          list-all-client-groups-with-their-member-counts-merges-persisted-groups-rows-in-client_groups-including-empty-placeholders-with-the-distinct-group_name-values-currently-set-on-clients-sorted-alphabetically-case-insensitive
+      - content: Return just the email list of clients that currently belong to the
      - content: >-
          Return just the email list of clients that currently belong to the
          given group. Useful for fanning a single bulk action over an entire
          group without round-tripping the full client list.
-        id: >-
+        id: return-just-the-email-list-of-clients-that-currently-belong-to-the-given-group-useful-for-fanning-a-single-bulk-action-over-an-entire-group-without-round-tripping-the-full-client-list
-          return-just-the-email-list-of-clients-that-currently-belong-to-the-given-group-useful-for-fanning-a-single-bulk-action-over-an-entire-group-without-round-tripping-the-full-client-list
+      - content: Create a new empty (placeholder) group. The group becomes selectable in
-      - content: >-
+          client forms and the filter drawer even before any client is added to
-          Create a new empty (placeholder) group. The group becomes selectable
+          it. Errors if a group with the same name already exists.
-          in client forms and the filter drawer even before any client is added
+        id: create-a-new-empty-placeholder-group-the-group-becomes-selectable-in-client-forms-and-the-filter-drawer-even-before-any-client-is-added-to-it-errors-if-a-group-with-the-same-name-already-exists
-          to it. Errors if a group with the same name already exists.
+      - content: Rename a group. The new name is applied to the client_groups row AND
        id: >-
          create-a-new-empty-placeholder-group-the-group-becomes-selectable-in-client-forms-and-the-filter-drawer-even-before-any-client-is-added-to-it-errors-if-a-group-with-the-same-name-already-exists
      - content: >-
          Rename a group. The new name is applied to the client_groups row AND
          propagated to every matching client (both clients.group_name and the
          client entry inside every owning inbound's settings JSON) in a single
          transaction. Returns the number of clients whose label was updated.
-        id: >-
+        id: rename-a-group-the-new-name-is-applied-to-the-client_groups-row-and-propagated-to-every-matching-client-both-clientsgroup_name-and-the-client-entry-inside-every-owning-inbounds-settings-json-in-a-single-transaction-returns-the-number-of-clients-whose-label-was-updated
-          rename-a-group-the-new-name-is-applied-to-the-client_groups-row-and-propagated-to-every-matching-client-both-clientsgroup_name-and-the-client-entry-inside-every-owning-inbounds-settings-json-in-a-single-transaction-returns-the-number-of-clients-whose-label-was-updated
+      - content: Remove a group. Deletes the client_groups row and clears the group
      - content: >-
          Remove a group. Deletes the client_groups row and clears the group
          label from every matching client (both clients.group_name and the
          inbound settings JSON). The clients themselves are NOT deleted — use
          /bulkDel after filtering by group for that. Returns the count of
          clients whose label was cleared.
-        id: >-
+        id: remove-a-group-deletes-the-client_groups-row-and-clears-the-group-label-from-every-matching-client-both-clientsgroup_name-and-the-inbound-settings-json-the-clients-themselves-are-not-deleted--use-bulkdel-after-filtering-by-group-for-that-returns-the-count-of-clients-whose-label-was-cleared
-          remove-a-group-deletes-the-client_groups-row-and-clears-the-group-label-from-every-matching-client-both-clientsgroup_name-and-the-inbound-settings-json-the-clients-themselves-are-not-deleted--use-bulkdel-after-filtering-by-group-for-that-returns-the-count-of-clients-whose-label-was-cleared
+      - content: Zero out a single client’s up/down counters. Re-enables the client
      - content: >-
          Zero out a single client’s up/down counters. Re-enables the client
          across every attached inbound and pushes the change to Xray (or the
          remote node) so depleted users can connect again immediately.
-        id: >-
+        id: zero-out-a-single-clients-updown-counters-re-enables-the-client-across-every-attached-inbound-and-pushes-the-change-to-xray-or-the-remote-node-so-depleted-users-can-connect-again-immediately
-          zero-out-a-single-clients-updown-counters-re-enables-the-client-across-every-attached-inbound-and-pushes-the-change-to-xray-or-the-remote-node-so-depleted-users-can-connect-again-immediately
+      - content: Manually adjust a client’s upload + download counters. Useful for
      - content: >-
          Manually adjust a client’s upload + download counters. Useful for
          migrations from external accounting systems.
-        id: >-
+        id: manually-adjust-a-clients-upload--download-counters-useful-for-migrations-from-external-accounting-systems
-          manually-adjust-a-clients-upload--download-counters-useful-for-migrations-from-external-accounting-systems
+      - content: List source IPs that have connected with the given client’s
      - content: >-
          List source IPs that have connected with the given client’s
          credentials. Returns an array of "ip (timestamp)" strings.
-        id: >-
+        id: list-source-ips-that-have-connected-with-the-given-clients-credentials-returns-an-array-of-ip-timestamp-strings
          list-source-ips-that-have-connected-with-the-given-clients-credentials-returns-an-array-of-ip-timestamp-strings
      - content: Reset the recorded IP list for a client.
        id: reset-the-recorded-ip-list-for-a-client
-      - content: >-
+      - content: List the emails of currently connected clients (last seen within the
          List the emails of currently connected clients (last seen within the
          heartbeat window), deduped across every node.
-        id: >-
+        id: list-the-emails-of-currently-connected-clients-last-seen-within-the-heartbeat-window-deduped-across-every-node
-          list-the-emails-of-currently-connected-clients-last-seen-within-the-heartbeat-window-deduped-across-every-node
+      - content: Online client emails grouped by the panelGuid of the node that
      - content: >-
          Online client emails grouped by the panelGuid of the node that
          physically hosts each client. The local panel uses its own GUID; each
          node (at any depth in a chain) uses its GUID. Lets the inbounds page
          attribute online status to the real node instead of the intermediate
          one it syncs through.
-        id: >-
+        id: online-client-emails-grouped-by-the-panelguid-of-the-node-that-physically-hosts-each-client-the-local-panel-uses-its-own-guid-each-node-at-any-depth-in-a-chain-uses-its-guid-lets-the-inbounds-page-attribute-online-status-to-the-real-node-instead-of-the-intermediate-one-it-syncs-through
-          online-client-emails-grouped-by-the-panelguid-of-the-node-that-physically-hosts-each-client-the-local-panel-uses-its-own-guid-each-node-at-any-depth-in-a-chain-uses-its-guid-lets-the-inbounds-page-attribute-online-status-to-the-real-node-instead-of-the-intermediate-one-it-syncs-through
+      - content: Per-client source IPs grouped by the panelGuid of the node that
      - content: >-
          Per-client source IPs grouped by the panelGuid of the node that
          observed them. Lets the central panel attribute and enforce per-client
          IP limits using the real visitor IPs each node sees, instead of the
          address of the intermediate panel it syncs through.
-        id: >-
+        id: per-client-source-ips-grouped-by-the-panelguid-of-the-node-that-observed-them-lets-the-central-panel-attribute-and-enforce-per-client-ip-limits-using-the-real-visitor-ips-each-node-sees-instead-of-the-address-of-the-intermediate-panel-it-syncs-through
-          per-client-source-ips-grouped-by-the-panelguid-of-the-node-that-observed-them-lets-the-central-panel-attribute-and-enforce-per-client-ip-limits-using-the-real-visitor-ips-each-node-sees-instead-of-the-address-of-the-intermediate-panel-it-syncs-through
+      - content: Inbound tags that carried traffic within the heartbeat window, grouped
      - content: >-
          Inbound tags that carried traffic within the heartbeat window, grouped
          by the hosting node's panelGuid. Pairs with onlinesByGuid so the
          inbounds page only marks a multi-inbound client online on the inbounds
          it actually used. Nodes that do not report per-inbound activity are
          absent.
-        id: >-
+        id: inbound-tags-that-carried-traffic-within-the-heartbeat-window-grouped-by-the-hosting-nodes-panelguid-pairs-with-onlinesbyguid-so-the-inbounds-page-only-marks-a-multi-inbound-client-online-on-the-inbounds-it-actually-used-nodes-that-do-not-report-per-inbound-activity-are-absent
          inbound-tags-that-carried-traffic-within-the-heartbeat-window-grouped-by-the-hosting-nodes-panelguid-pairs-with-onlinesbyguid-so-the-inbounds-page-only-marks-a-multi-inbound-client-online-on-the-inbounds-it-actually-used-nodes-that-do-not-report-per-inbound-activity-are-absent
      - content: Map of client email → last-seen unix timestamp.
        id: map-of-client-email--last-seen-unix-timestamp
      - content: Traffic counters for a client identified by email.
        id: traffic-counters-for-a-client-identified-by-email
-      - content: >-
+      - content: Return every protocol URL (vless://, vmess://, trojan://, ss://,
          Return every protocol URL (vless://, vmess://, trojan://, ss://,
          hysteria://, hy2://) for clients matching the subscription ID. Same
          result set as /sub/<subId>, but as a JSON array — no base64. When an
          inbound has streamSettings.externalProxy set, one URL is emitted per
          external proxy. Empty array when the subId has no enabled clients.
-        id: >-
+        id: return-every-protocol-url-vless-vmess-trojan-ss-hysteria-hy2-for-clients-matching-the-subscription-id-same-result-set-as-subsubid-but-as-a-json-array--no-base64-when-an-inbound-has-streamsettingsexternalproxy-set-one-url-is-emitted-per-external-proxy-empty-array-when-the-subid-has-no-enabled-clients
-          return-every-protocol-url-vless-vmess-trojan-ss-hysteria-hy2-for-clients-matching-the-subscription-id-same-result-set-as-subsubid-but-as-a-json-array--no-base64-when-an-inbound-has-streamsettingsexternalproxy-set-one-url-is-emitted-per-external-proxy-empty-array-when-the-subid-has-no-enabled-clients
+      - content: 'Return every URL for one client across all attached inbounds — the
      - content: >-
          Return every URL for one client across all attached inbounds — the
          same strings the Copy URL button copies in the panel UI. Supported
          protocols: vmess, vless, trojan, shadowsocks, hysteria. If
          streamSettings.externalProxy is set, returns one URL per external
          proxy. Protocols without a URL form (socks, http, mixed, wireguard,
-          dokodemo, tunnel) contribute nothing.
+          dokodemo, tunnel) contribute nothing.'
-        id: >-
+        id: return-every-url-for-one-client-across-all-attached-inbounds--the-same-strings-the-copy-url-button-copies-in-the-panel-ui-supported-protocols-vmess-vless-trojan-shadowsocks-hysteria-if-streamsettingsexternalproxy-is-set-returns-one-url-per-external-proxy-protocols-without-a-url-form-socks-http-mixed-wireguard-dokodemo-tunnel-contribute-nothing
          return-every-url-for-one-client-across-all-attached-inbounds--the-same-strings-the-copy-url-button-copies-in-the-panel-ui-supported-protocols-vmess-vless-trojan-shadowsocks-hysteria-if-streamsettingsexternalproxy-is-set-returns-one-url-per-external-proxy-protocols-without-a-url-form-socks-http-mixed-wireguard-dokodemo-tunnel-contribute-nothing
    contents: []
 ---
@@ -1,7 +1,6 @@
 ---
 title: Hosts
-description: >-
+description: Per-inbound override endpoints. Each enabled host renders one extra
  Per-inbound override endpoints. Each enabled host renders one extra
  subscription link/proxy with its own address/port/TLS, superseding the legacy
  externalProxy array. All endpoints under /panel/api/hosts.
 full: true
@@ -10,11 +9,9 @@ _openapi:
    - ./public/openapi.json
  toc:
    - depth: 2
-      title: >-
+      title: List every host across all inbounds, grouped by inbound then ordered by
        List every host across all inbounds, grouped by inbound then ordered by
        sort order.
-      url: >-
+      url: '#list-every-host-across-all-inbounds-grouped-by-inbound-then-ordered-by-sort-order'
        #list-every-host-across-all-inbounds-grouped-by-inbound-then-ordered-by-sort-order
    - depth: 2
      title: Fetch a single host by ID.
      url: '#fetch-a-single-host-by-id'
@@ -25,26 +22,20 @@ _openapi:
      title: Distinct, sorted set of tags used across all hosts.
      url: '#distinct-sorted-set-of-tags-used-across-all-hosts'
    - depth: 2
-      title: >-
+      title: Create a host on an inbound. inboundId and remark are required; security
        Create a host on an inbound. inboundId and remark are required; security
        defaults to "same" (inherit the inbound).
-      url: >-
+      url: '#create-a-host-on-an-inbound-inboundid-and-remark-are-required-security-defaults-to-same-inherit-the-inbound'
        #create-a-host-on-an-inbound-inboundid-and-remark-are-required-security-defaults-to-same-inherit-the-inbound
    - depth: 2
-      title: >-
+      title: Replace a host’s content. The inbound and sort order are immutable here
        Replace a host’s content. The inbound and sort order are immutable here
        (use /reorder for ordering).
-      url: >-
+      url: '#replace-a-hosts-content-the-inbound-and-sort-order-are-immutable-here-use-reorder-for-ordering'
        #replace-a-hosts-content-the-inbound-and-sort-order-are-immutable-here-use-reorder-for-ordering
    - depth: 2
      title: Delete a host.
      url: '#delete-a-host'
    - depth: 2
-      title: >-
+      title: Enable or disable a single host (disabled hosts are skipped in
        Enable or disable a single host (disabled hosts are skipped in
        subscriptions).
-      url: >-
+      url: '#enable-or-disable-a-single-host-disabled-hosts-are-skipped-in-subscriptions'
        #enable-or-disable-a-single-host-disabled-hosts-are-skipped-in-subscriptions
    - depth: 2
      title: Set host sort order by the position of each id in the array.
      url: '#set-host-sort-order-by-the-position-of-each-id-in-the-array'
@@ -56,34 +47,26 @@ _openapi:
      url: '#delete-many-hosts-in-one-call'
  structuredData:
    headings:
-      - content: >-
+      - content: List every host across all inbounds, grouped by inbound then ordered by
-          List every host across all inbounds, grouped by inbound then ordered
+          sort order.
-          by sort order.
+        id: list-every-host-across-all-inbounds-grouped-by-inbound-then-ordered-by-sort-order
        id: >-
          list-every-host-across-all-inbounds-grouped-by-inbound-then-ordered-by-sort-order
      - content: Fetch a single host by ID.
        id: fetch-a-single-host-by-id
      - content: Fetch one inbound's hosts, ordered by sort order then id.
        id: fetch-one-inbounds-hosts-ordered-by-sort-order-then-id
      - content: Distinct, sorted set of tags used across all hosts.
        id: distinct-sorted-set-of-tags-used-across-all-hosts
-      - content: >-
+      - content: Create a host on an inbound. inboundId and remark are required;
          Create a host on an inbound. inboundId and remark are required;
          security defaults to "same" (inherit the inbound).
-        id: >-
+        id: create-a-host-on-an-inbound-inboundid-and-remark-are-required-security-defaults-to-same-inherit-the-inbound
-          create-a-host-on-an-inbound-inboundid-and-remark-are-required-security-defaults-to-same-inherit-the-inbound
+      - content: Replace a host’s content. The inbound and sort order are immutable here
-      - content: >-
+          (use /reorder for ordering).
-          Replace a host’s content. The inbound and sort order are immutable
+        id: replace-a-hosts-content-the-inbound-and-sort-order-are-immutable-here-use-reorder-for-ordering
          here (use /reorder for ordering).
        id: >-
          replace-a-hosts-content-the-inbound-and-sort-order-are-immutable-here-use-reorder-for-ordering
      - content: Delete a host.
        id: delete-a-host
-      - content: >-
+      - content: Enable or disable a single host (disabled hosts are skipped in
          Enable or disable a single host (disabled hosts are skipped in
          subscriptions).
-        id: >-
+        id: enable-or-disable-a-single-host-disabled-hosts-are-skipped-in-subscriptions
          enable-or-disable-a-single-host-disabled-hosts-are-skipped-in-subscriptions
      - content: Set host sort order by the position of each id in the array.
        id: set-host-sort-order-by-the-position-of-each-id-in-the-array
      - content: Enable or disable many hosts in one call.
@@ -1,65 +1,48 @@
 ---
 title: Server
-description: >-
+description: System status, log retrieval, certificate generators, Xray binary
-  System status, log retrieval, certificate generators, Xray binary management,
+  management, and backup/restore. All under /panel/api/server.
  and backup/restore. All under /panel/api/server.
 full: true
 _openapi:
  preload:
    - ./public/openapi.json
  toc:
    - depth: 2
-      title: >-
+      title: 'Real-time machine snapshot: CPU, memory, swap, disk, network IO, load
        Real-time machine snapshot: CPU, memory, swap, disk, network IO, load
        averages, open connections, Xray state. Cached and refreshed every 2
-        seconds in the background.
+        seconds in the background.'
-      url: >-
+      url: '#real-time-machine-snapshot-cpu-memory-swap-disk-network-io-load-averages-open-connections-xray-state-cached-and-refreshed-every-2-seconds-in-the-background'
        #real-time-machine-snapshot-cpu-memory-swap-disk-network-io-load-averages-open-connections-xray-state-cached-and-refreshed-every-2-seconds-in-the-background
    - depth: 2
-      title: >-
+      title: Reports whether per-client IP limits can be enforced on this host. The
        Reports whether per-client IP limits can be enforced on this host. The
        panel uses it to gate the "IP Limit" field, since enforcement depends on
        Fail2ban being installed.
-      url: >-
+      url: '#reports-whether-per-client-ip-limits-can-be-enforced-on-this-host-the-panel-uses-it-to-gate-the-ip-limit-field-since-enforcement-depends-on-fail2ban-being-installed'
        #reports-whether-per-client-ip-limits-can-be-enforced-on-this-host-the-panel-uses-it-to-gate-the-ip-limit-field-since-enforcement-depends-on-fail2ban-being-installed
    - depth: 2
-      title: >-
+      title: 'Legacy: aggregated CPU history. Use /history/cpu/:bucket instead — same
-        Legacy: aggregated CPU history. Use /history/cpu/:bucket instead — same
+        data with a uniform {t, v} shape.'
-        data with a uniform {t, v} shape.
+      url: '#legacy-aggregated-cpu-history-use-historycpubucket-instead--same-data-with-a-uniform-t-v-shape'
      url: >-
        #legacy-aggregated-cpu-history-use-historycpubucket-instead--same-data-with-a-uniform-t-v-shape
    - depth: 2
-      title: >-
+      title: Aggregated time-series for one metric. Returns an array of {t, v} samples
-        Aggregated time-series for one metric. Returns an array of {t, v}
+        covering the last ~6 hours.
-        samples covering the last ~6 hours.
+      url: '#aggregated-time-series-for-one-metric-returns-an-array-of-t-v-samples-covering-the-last-6-hours'
      url: >-
        #aggregated-time-series-for-one-metric-returns-an-array-of-t-v-samples-covering-the-last-6-hours
    - depth: 2
-      title: >-
+      title: Xray runtime metrics state — whether the xray config has a `metrics`
        Xray runtime metrics state — whether the xray config has a `metrics`
        block, which expvar keys are flowing, and the current snapshot values
        for each. Returns an empty state when metrics are not configured.
-      url: >-
+      url: '#xray-runtime-metrics-state--whether-the-xray-config-has-a-metrics-block-which-expvar-keys-are-flowing-and-the-current-snapshot-values-for-each-returns-an-empty-state-when-metrics-are-not-configured'
        #xray-runtime-metrics-state--whether-the-xray-config-has-a-metrics-block-which-expvar-keys-are-flowing-and-the-current-snapshot-values-for-each-returns-an-empty-state-when-metrics-are-not-configured
    - depth: 2
-      title: >-
+      title: Time-series history for one Xray runtime metric over the last ~6 hours.
        Time-series history for one Xray runtime metric over the last ~6 hours.
        Same {t, v} shape as /history/:metric/:bucket.
-      url: >-
+      url: '#time-series-history-for-one-xray-runtime-metric-over-the-last-6-hours-same-t-v-shape-as-historymetricbucket'
        #time-series-history-for-one-xray-runtime-metric-over-the-last-6-hours-same-t-v-shape-as-historymetricbucket
    - depth: 2
-      title: >-
+      title: Latest snapshot from the Xray observatory — per-outbound latency, health
        Latest snapshot from the Xray observatory — per-outbound latency, health
        status, and last-probe time. Only populated when the Xray config has an
        observatory configured.
-      url: >-
+      url: '#latest-snapshot-from-the-xray-observatory--per-outbound-latency-health-status-and-last-probe-time-only-populated-when-the-xray-config-has-an-observatory-configured'
        #latest-snapshot-from-the-xray-observatory--per-outbound-latency-health-status-and-last-probe-time-only-populated-when-the-xray-config-has-an-observatory-configured
    - depth: 2
-      title: >-
+      title: Time-series of observatory probe results for one outbound tag. Same {t,
        Time-series of observatory probe results for one outbound tag. Same {t,
        v} shape as the other history endpoints.
-      url: >-
+      url: '#time-series-of-observatory-probe-results-for-one-outbound-tag-same-t-v-shape-as-the-other-history-endpoints'
        #time-series-of-observatory-probe-results-for-one-outbound-tag-same-t-v-shape-as-the-other-history-endpoints
    - depth: 2
      title: List Xray binary versions available for install on this host.
      url: '#list-xray-binary-versions-available-for-install-on-this-host'
@@ -70,90 +53,66 @@ _openapi:
      title: Return the assembled Xray config that’s currently running on this host.
      url: '#return-the-assembled-xray-config-thats-currently-running-on-this-host'
    - depth: 2
-      title: >-
+      title: Stream the SQLite database file as an attachment. Use as a manual backup.
        Stream the SQLite database file as an attachment. Use as a manual
        backup.
      url: '#stream-the-sqlite-database-file-as-an-attachment-use-as-a-manual-backup'
    - depth: 2
-      title: >-
+      title: 'Stream a cross-engine migration file as an attachment: a .dump (SQL
        Stream a cross-engine migration file as an attachment: a .dump (SQL
        text) on SQLite, or a .db SQLite database built from the live data on
-        PostgreSQL.
+        PostgreSQL.'
-      url: >-
+      url: '#stream-a-cross-engine-migration-file-as-an-attachment-a-dump-sql-text-on-sqlite-or-a-db-sqlite-database-built-from-the-live-data-on-postgresql'
        #stream-a-cross-engine-migration-file-as-an-attachment-a-dump-sql-text-on-sqlite-or-a-db-sqlite-database-built-from-the-live-data-on-postgresql
    - depth: 2
      title: Generate a fresh UUID v4. Convenience helper for client IDs.
      url: '#generate-a-fresh-uuid-v4-convenience-helper-for-client-ids'
    - depth: 2
-      title: >-
+      title: Return this panel's own web TLS certificate and key file paths. The
        Return this panel's own web TLS certificate and key file paths. The
        central panel calls it on a node (via the node API token) so "Set Cert
        from Panel" fills a node-assigned inbound with paths that exist on the
        node.
-      url: >-
+      url: '#return-this-panels-own-web-tls-certificate-and-key-file-paths-the-central-panel-calls-it-on-a-node-via-the-node-api-token-so-set-cert-from-panel-fills-a-node-assigned-inbound-with-paths-that-exist-on-the-node'
        #return-this-panels-own-web-tls-certificate-and-key-file-paths-the-central-panel-calls-it-on-a-node-via-the-node-api-token-so-set-cert-from-panel-fills-a-node-assigned-inbound-with-paths-that-exist-on-the-node
    - depth: 2
-      title: >-
+      title: Read-only summaries (guid, parentGuid, name, address, status, versions)
        Read-only summaries (guid, parentGuid, name, address, status, versions)
        of the nodes this panel manages. A parent panel calls it on a node (via
        the node API token) to surface transitive sub-nodes in a chained
        topology. Counts are computed by the parent, not returned here.
-      url: >-
+      url: '#read-only-summaries-guid-parentguid-name-address-status-versions-of-the-nodes-this-panel-manages-a-parent-panel-calls-it-on-a-node-via-the-node-api-token-to-surface-transitive-sub-nodes-in-a-chained-topology-counts-are-computed-by-the-parent-not-returned-here'
        #read-only-summaries-guid-parentguid-name-address-status-versions-of-the-nodes-this-panel-manages-a-parent-panel-calls-it-on-a-node-via-the-node-api-token-to-surface-transitive-sub-nodes-in-a-chained-topology-counts-are-computed-by-the-parent-not-returned-here
    - depth: 2
      title: Generate a new X25519 keypair for Reality.
      url: '#generate-a-new-x25519-keypair-for-reality'
    - depth: 2
-      title: >-
+      title: Generate a new ML-DSA-65 keypair (post-quantum signature). Returns
        Generate a new ML-DSA-65 keypair (post-quantum signature). Returns
        {privateKey, publicKey, seed}.
-      url: >-
+      url: '#generate-a-new-ml-dsa-65-keypair-post-quantum-signature-returns-privatekey-publickey-seed'
        #generate-a-new-ml-dsa-65-keypair-post-quantum-signature-returns-privatekey-publickey-seed
    - depth: 2
-      title: >-
+      title: Generate a new ML-KEM-768 keypair (post-quantum KEM). Returns {clientKey,
-        Generate a new ML-KEM-768 keypair (post-quantum KEM). Returns
+        serverKey}.
-        {clientKey, serverKey}.
+      url: '#generate-a-new-ml-kem-768-keypair-post-quantum-kem-returns-clientkey-serverkey'
      url: >-
        #generate-a-new-ml-kem-768-keypair-post-quantum-kem-returns-clientkey-serverkey
    - depth: 2
-      title: >-
+      title: Generate VLESS encryption auth options. Returns an auths array each with
        Generate VLESS encryption auth options. Returns an auths array each with
        id, label, encryption, and decryption fields.
-      url: >-
+      url: '#generate-vless-encryption-auth-options-returns-an-auths-array-each-with-id-label-encryption-and-decryption-fields'
        #generate-vless-encryption-auth-options-returns-an-auths-array-each-with-id-label-encryption-and-decryption-fields
    - depth: 2
      title: Stop the Xray binary. All proxies go offline immediately.
      url: '#stop-the-xray-binary-all-proxies-go-offline-immediately'
    - depth: 2
-      title: >-
+      title: Reload Xray with the current config. Typically required after structural
        Reload Xray with the current config. Typically required after structural
        inbound or routing changes.
-      url: >-
+      url: '#reload-xray-with-the-current-config-typically-required-after-structural-inbound-or-routing-changes'
        #reload-xray-with-the-current-config-typically-required-after-structural-inbound-or-routing-changes
    - depth: 2
-      title: >-
+      title: Download and install the specified Xray version. Pass "latest" for the
        Download and install the specified Xray version. Pass "latest" for the
        newest release.
-      url: >-
+      url: '#download-and-install-the-specified-xray-version-pass-latest-for-the-newest-release'
        #download-and-install-the-specified-xray-version-pass-latest-for-the-newest-release
    - depth: 2
-      title: >-
+      title: Self-update the panel to the latest version. The server restarts on
        Self-update the panel to the latest version. The server restarts on
        success.
-      url: >-
+      url: '#self-update-the-panel-to-the-latest-version-the-server-restarts-on-success'
        #self-update-the-panel-to-the-latest-version-the-server-restarts-on-success
    - depth: 2
-      title: >-
+      title: Toggle the panel update channel between stable and the rolling per-commit
-        Toggle the panel update channel between stable and the rolling
+        dev release. Only effective on dev builds.
-        per-commit dev release. Only effective on dev builds.
+      url: '#toggle-the-panel-update-channel-between-stable-and-the-rolling-per-commit-dev-release-only-effective-on-dev-builds'
      url: >-
        #toggle-the-panel-update-channel-between-stable-and-the-rolling-per-commit-dev-release-only-effective-on-dev-builds
    - depth: 2
-      title: >-
+      title: Refresh the default GeoIP / GeoSite data files. Body can include a
        Refresh the default GeoIP / GeoSite data files. Body can include a
        fileName, or use the /:fileName variant.
-      url: >-
+      url: '#refresh-the-default-geoip--geosite-data-files-body-can-include-a-filename-or-use-the-filename-variant'
        #refresh-the-default-geoip--geosite-data-files-body-can-include-a-filename-or-use-the-filename-variant
    - depth: 2
      title: Refresh a single Geo file by filename (e.g. geoip.dat, geosite.dat).
      url: '#refresh-a-single-geo-file-by-filename-eg-geoipdat-geositedat'
@@ -164,205 +123,138 @@ _openapi:
      title: Return the last N lines of the Xray process log.
      url: '#return-the-last-n-lines-of-the-xray-process-log'
    - depth: 2
-      title: >-
+      title: Restore the panel DB from an uploaded SQLite file (multipart form, field
        Restore the panel DB from an uploaded SQLite file (multipart form, field
        name "db"). The panel restarts after restore. Destructive.
-      url: >-
+      url: '#restore-the-panel-db-from-an-uploaded-sqlite-file-multipart-form-field-name-db-the-panel-restarts-after-restore-destructive'
        #restore-the-panel-db-from-an-uploaded-sqlite-file-multipart-form-field-name-db-the-panel-restarts-after-restore-destructive
    - depth: 2
-      title: >-
+      title: Generate a new ECH (Encrypted Client Hello) keypair and config list for
        Generate a new ECH (Encrypted Client Hello) keypair and config list for
        the given SNI.
-      url: >-
+      url: '#generate-a-new-ech-encrypted-client-hello-keypair-and-config-list-for-the-given-sni'
        #generate-a-new-ech-encrypted-client-hello-keypair-and-config-list-for-the-given-sni
    - depth: 2
-      title: >-
+      title: Compute the hex SHA-256 of a certificate (DER) for pinning
        Compute the hex SHA-256 of a certificate (DER) for pinning
        (pinnedPeerCertSha256). Provide either a server file path or inline
        PEM/DER content.
-      url: >-
+      url: '#compute-the-hex-sha-256-of-a-certificate-der-for-pinning-pinnedpeercertsha256-provide-either-a-server-file-path-or-inline-pemder-content'
        #compute-the-hex-sha-256-of-a-certificate-der-for-pinning-pinnedpeercertsha256-provide-either-a-server-file-path-or-inline-pemder-content
    - depth: 2
-      title: >-
+      title: Run `xray tls ping` against a remote server and return its live
        Run `xray tls ping` against a remote server and return its live
        leaf-certificate SHA-256 hash(es) for pinning (pinnedPeerCertSha256).
-      url: >-
+      url: '#run-xray-tls-ping-against-a-remote-server-and-return-its-live-leaf-certificate-sha-256-hashes-for-pinning-pinnedpeercertsha256'
        #run-xray-tls-ping-against-a-remote-server-and-return-its-live-leaf-certificate-sha-256-hashes-for-pinning-pinnedpeercertsha256
    - depth: 2
-      title: >-
+      title: Fetch the fully aggregated inbound_client_ips database table. Used by
        Fetch the fully aggregated inbound_client_ips database table. Used by
        nodes to sync recently active IPs across the cluster.
-      url: >-
+      url: '#fetch-the-fully-aggregated-inbound_client_ips-database-table-used-by-nodes-to-sync-recently-active-ips-across-the-cluster'
        #fetch-the-fully-aggregated-inbound_client_ips-database-table-used-by-nodes-to-sync-recently-active-ips-across-the-cluster
    - depth: 2
-      title: >-
+      title: Submit a list of recently active IP timestamps. The panel merges them
        Submit a list of recently active IP timestamps. The panel merges them
        with the existing database to maintain a unified global IP-limit view.
-      url: >-
+      url: '#submit-a-list-of-recently-active-ip-timestamps-the-panel-merges-them-with-the-existing-database-to-maintain-a-unified-global-ip-limit-view'
        #submit-a-list-of-recently-active-ip-timestamps-the-panel-merges-them-with-the-existing-database-to-maintain-a-unified-global-ip-limit-view
  structuredData:
    headings:
-      - content: >-
+      - content: 'Real-time machine snapshot: CPU, memory, swap, disk, network IO, load
          Real-time machine snapshot: CPU, memory, swap, disk, network IO, load
          averages, open connections, Xray state. Cached and refreshed every 2
-          seconds in the background.
+          seconds in the background.'
-        id: >-
+        id: real-time-machine-snapshot-cpu-memory-swap-disk-network-io-load-averages-open-connections-xray-state-cached-and-refreshed-every-2-seconds-in-the-background
-          real-time-machine-snapshot-cpu-memory-swap-disk-network-io-load-averages-open-connections-xray-state-cached-and-refreshed-every-2-seconds-in-the-background
+      - content: Reports whether per-client IP limits can be enforced on this host. The
      - content: >-
          Reports whether per-client IP limits can be enforced on this host. The
          panel uses it to gate the "IP Limit" field, since enforcement depends
          on Fail2ban being installed.
-        id: >-
+        id: reports-whether-per-client-ip-limits-can-be-enforced-on-this-host-the-panel-uses-it-to-gate-the-ip-limit-field-since-enforcement-depends-on-fail2ban-being-installed
-          reports-whether-per-client-ip-limits-can-be-enforced-on-this-host-the-panel-uses-it-to-gate-the-ip-limit-field-since-enforcement-depends-on-fail2ban-being-installed
+      - content: 'Legacy: aggregated CPU history. Use /history/cpu/:bucket instead —
-      - content: >-
+          same data with a uniform {t, v} shape.'
-          Legacy: aggregated CPU history. Use /history/cpu/:bucket instead —
+        id: legacy-aggregated-cpu-history-use-historycpubucket-instead--same-data-with-a-uniform-t-v-shape
-          same data with a uniform {t, v} shape.
+      - content: Aggregated time-series for one metric. Returns an array of {t, v}
        id: >-
          legacy-aggregated-cpu-history-use-historycpubucket-instead--same-data-with-a-uniform-t-v-shape
      - content: >-
          Aggregated time-series for one metric. Returns an array of {t, v}
          samples covering the last ~6 hours.
-        id: >-
+        id: aggregated-time-series-for-one-metric-returns-an-array-of-t-v-samples-covering-the-last-6-hours
-          aggregated-time-series-for-one-metric-returns-an-array-of-t-v-samples-covering-the-last-6-hours
+      - content: Xray runtime metrics state — whether the xray config has a `metrics`
      - content: >-
          Xray runtime metrics state — whether the xray config has a `metrics`
          block, which expvar keys are flowing, and the current snapshot values
          for each. Returns an empty state when metrics are not configured.
-        id: >-
+        id: xray-runtime-metrics-state--whether-the-xray-config-has-a-metrics-block-which-expvar-keys-are-flowing-and-the-current-snapshot-values-for-each-returns-an-empty-state-when-metrics-are-not-configured
-          xray-runtime-metrics-state--whether-the-xray-config-has-a-metrics-block-which-expvar-keys-are-flowing-and-the-current-snapshot-values-for-each-returns-an-empty-state-when-metrics-are-not-configured
+      - content: Time-series history for one Xray runtime metric over the last ~6 hours.
-      - content: >-
+          Same {t, v} shape as /history/:metric/:bucket.
-          Time-series history for one Xray runtime metric over the last ~6
+        id: time-series-history-for-one-xray-runtime-metric-over-the-last-6-hours-same-t-v-shape-as-historymetricbucket
-          hours. Same {t, v} shape as /history/:metric/:bucket.
+      - content: Latest snapshot from the Xray observatory — per-outbound latency,
        id: >-
          time-series-history-for-one-xray-runtime-metric-over-the-last-6-hours-same-t-v-shape-as-historymetricbucket
      - content: >-
          Latest snapshot from the Xray observatory — per-outbound latency,
          health status, and last-probe time. Only populated when the Xray
          config has an observatory configured.
-        id: >-
+        id: latest-snapshot-from-the-xray-observatory--per-outbound-latency-health-status-and-last-probe-time-only-populated-when-the-xray-config-has-an-observatory-configured
-          latest-snapshot-from-the-xray-observatory--per-outbound-latency-health-status-and-last-probe-time-only-populated-when-the-xray-config-has-an-observatory-configured
+      - content: Time-series of observatory probe results for one outbound tag. Same {t,
-      - content: >-
+          v} shape as the other history endpoints.
-          Time-series of observatory probe results for one outbound tag. Same
+        id: time-series-of-observatory-probe-results-for-one-outbound-tag-same-t-v-shape-as-the-other-history-endpoints
          {t, v} shape as the other history endpoints.
        id: >-
          time-series-of-observatory-probe-results-for-one-outbound-tag-same-t-v-shape-as-the-other-history-endpoints
      - content: List Xray binary versions available for install on this host.
        id: list-xray-binary-versions-available-for-install-on-this-host
      - content: Check whether a newer 3x-ui release is available on GitHub.
        id: check-whether-a-newer-3x-ui-release-is-available-on-github
-      - content: >-
+      - content: Return the assembled Xray config that’s currently running on this host.
          Return the assembled Xray config that’s currently running on this
          host.
        id: return-the-assembled-xray-config-thats-currently-running-on-this-host
-      - content: >-
+      - content: Stream the SQLite database file as an attachment. Use as a manual
          Stream the SQLite database file as an attachment. Use as a manual
          backup.
-        id: >-
+        id: stream-the-sqlite-database-file-as-an-attachment-use-as-a-manual-backup
-          stream-the-sqlite-database-file-as-an-attachment-use-as-a-manual-backup
+      - content: 'Stream a cross-engine migration file as an attachment: a .dump (SQL
      - content: >-
          Stream a cross-engine migration file as an attachment: a .dump (SQL
          text) on SQLite, or a .db SQLite database built from the live data on
-          PostgreSQL.
+          PostgreSQL.'
-        id: >-
+        id: stream-a-cross-engine-migration-file-as-an-attachment-a-dump-sql-text-on-sqlite-or-a-db-sqlite-database-built-from-the-live-data-on-postgresql
          stream-a-cross-engine-migration-file-as-an-attachment-a-dump-sql-text-on-sqlite-or-a-db-sqlite-database-built-from-the-live-data-on-postgresql
      - content: Generate a fresh UUID v4. Convenience helper for client IDs.
        id: generate-a-fresh-uuid-v4-convenience-helper-for-client-ids
-      - content: >-
+      - content: Return this panel's own web TLS certificate and key file paths. The
          Return this panel's own web TLS certificate and key file paths. The
          central panel calls it on a node (via the node API token) so "Set Cert
          from Panel" fills a node-assigned inbound with paths that exist on the
          node.
-        id: >-
+        id: return-this-panels-own-web-tls-certificate-and-key-file-paths-the-central-panel-calls-it-on-a-node-via-the-node-api-token-so-set-cert-from-panel-fills-a-node-assigned-inbound-with-paths-that-exist-on-the-node
-          return-this-panels-own-web-tls-certificate-and-key-file-paths-the-central-panel-calls-it-on-a-node-via-the-node-api-token-so-set-cert-from-panel-fills-a-node-assigned-inbound-with-paths-that-exist-on-the-node
+      - content: Read-only summaries (guid, parentGuid, name, address, status, versions)
-      - content: >-
+          of the nodes this panel manages. A parent panel calls it on a node
-          Read-only summaries (guid, parentGuid, name, address, status,
+          (via the node API token) to surface transitive sub-nodes in a chained
-          versions) of the nodes this panel manages. A parent panel calls it on
+          topology. Counts are computed by the parent, not returned here.
-          a node (via the node API token) to surface transitive sub-nodes in a
+        id: read-only-summaries-guid-parentguid-name-address-status-versions-of-the-nodes-this-panel-manages-a-parent-panel-calls-it-on-a-node-via-the-node-api-token-to-surface-transitive-sub-nodes-in-a-chained-topology-counts-are-computed-by-the-parent-not-returned-here
          chained topology. Counts are computed by the parent, not returned
          here.
        id: >-
          read-only-summaries-guid-parentguid-name-address-status-versions-of-the-nodes-this-panel-manages-a-parent-panel-calls-it-on-a-node-via-the-node-api-token-to-surface-transitive-sub-nodes-in-a-chained-topology-counts-are-computed-by-the-parent-not-returned-here
      - content: Generate a new X25519 keypair for Reality.
        id: generate-a-new-x25519-keypair-for-reality
-      - content: >-
+      - content: Generate a new ML-DSA-65 keypair (post-quantum signature). Returns
          Generate a new ML-DSA-65 keypair (post-quantum signature). Returns
          {privateKey, publicKey, seed}.
-        id: >-
+        id: generate-a-new-ml-dsa-65-keypair-post-quantum-signature-returns-privatekey-publickey-seed
-          generate-a-new-ml-dsa-65-keypair-post-quantum-signature-returns-privatekey-publickey-seed
+      - content: Generate a new ML-KEM-768 keypair (post-quantum KEM). Returns
      - content: >-
          Generate a new ML-KEM-768 keypair (post-quantum KEM). Returns
          {clientKey, serverKey}.
-        id: >-
+        id: generate-a-new-ml-kem-768-keypair-post-quantum-kem-returns-clientkey-serverkey
-          generate-a-new-ml-kem-768-keypair-post-quantum-kem-returns-clientkey-serverkey
+      - content: Generate VLESS encryption auth options. Returns an auths array each
      - content: >-
          Generate VLESS encryption auth options. Returns an auths array each
          with id, label, encryption, and decryption fields.
-        id: >-
+        id: generate-vless-encryption-auth-options-returns-an-auths-array-each-with-id-label-encryption-and-decryption-fields
          generate-vless-encryption-auth-options-returns-an-auths-array-each-with-id-label-encryption-and-decryption-fields
      - content: Stop the Xray binary. All proxies go offline immediately.
        id: stop-the-xray-binary-all-proxies-go-offline-immediately
-      - content: >-
+      - content: Reload Xray with the current config. Typically required after
          Reload Xray with the current config. Typically required after
          structural inbound or routing changes.
-        id: >-
+        id: reload-xray-with-the-current-config-typically-required-after-structural-inbound-or-routing-changes
-          reload-xray-with-the-current-config-typically-required-after-structural-inbound-or-routing-changes
+      - content: Download and install the specified Xray version. Pass "latest" for the
      - content: >-
          Download and install the specified Xray version. Pass "latest" for the
          newest release.
-        id: >-
+        id: download-and-install-the-specified-xray-version-pass-latest-for-the-newest-release
-          download-and-install-the-specified-xray-version-pass-latest-for-the-newest-release
+      - content: Self-update the panel to the latest version. The server restarts on
      - content: >-
          Self-update the panel to the latest version. The server restarts on
          success.
-        id: >-
+        id: self-update-the-panel-to-the-latest-version-the-server-restarts-on-success
-          self-update-the-panel-to-the-latest-version-the-server-restarts-on-success
+      - content: Toggle the panel update channel between stable and the rolling
      - content: >-
          Toggle the panel update channel between stable and the rolling
          per-commit dev release. Only effective on dev builds.
-        id: >-
+        id: toggle-the-panel-update-channel-between-stable-and-the-rolling-per-commit-dev-release-only-effective-on-dev-builds
-          toggle-the-panel-update-channel-between-stable-and-the-rolling-per-commit-dev-release-only-effective-on-dev-builds
+      - content: Refresh the default GeoIP / GeoSite data files. Body can include a
      - content: >-
          Refresh the default GeoIP / GeoSite data files. Body can include a
          fileName, or use the /:fileName variant.
-        id: >-
+        id: refresh-the-default-geoip--geosite-data-files-body-can-include-a-filename-or-use-the-filename-variant
          refresh-the-default-geoip--geosite-data-files-body-can-include-a-filename-or-use-the-filename-variant
      - content: Refresh a single Geo file by filename (e.g. geoip.dat, geosite.dat).
        id: refresh-a-single-geo-file-by-filename-eg-geoipdat-geositedat
      - content: Return the last N lines of the panel’s own log.
        id: return-the-last-n-lines-of-the-panels-own-log
      - content: Return the last N lines of the Xray process log.
        id: return-the-last-n-lines-of-the-xray-process-log
-      - content: >-
+      - content: Restore the panel DB from an uploaded SQLite file (multipart form,
          Restore the panel DB from an uploaded SQLite file (multipart form,
          field name "db"). The panel restarts after restore. Destructive.
-        id: >-
+        id: restore-the-panel-db-from-an-uploaded-sqlite-file-multipart-form-field-name-db-the-panel-restarts-after-restore-destructive
-          restore-the-panel-db-from-an-uploaded-sqlite-file-multipart-form-field-name-db-the-panel-restarts-after-restore-destructive
+      - content: Generate a new ECH (Encrypted Client Hello) keypair and config list for
-      - content: >-
+          the given SNI.
-          Generate a new ECH (Encrypted Client Hello) keypair and config list
+        id: generate-a-new-ech-encrypted-client-hello-keypair-and-config-list-for-the-given-sni
-          for the given SNI.
+      - content: Compute the hex SHA-256 of a certificate (DER) for pinning
        id: >-
          generate-a-new-ech-encrypted-client-hello-keypair-and-config-list-for-the-given-sni
      - content: >-
          Compute the hex SHA-256 of a certificate (DER) for pinning
          (pinnedPeerCertSha256). Provide either a server file path or inline
          PEM/DER content.
-        id: >-
+        id: compute-the-hex-sha-256-of-a-certificate-der-for-pinning-pinnedpeercertsha256-provide-either-a-server-file-path-or-inline-pemder-content
-          compute-the-hex-sha-256-of-a-certificate-der-for-pinning-pinnedpeercertsha256-provide-either-a-server-file-path-or-inline-pemder-content
+      - content: Run `xray tls ping` against a remote server and return its live
      - content: >-
          Run `xray tls ping` against a remote server and return its live
          leaf-certificate SHA-256 hash(es) for pinning (pinnedPeerCertSha256).
-        id: >-
+        id: run-xray-tls-ping-against-a-remote-server-and-return-its-live-leaf-certificate-sha-256-hashes-for-pinning-pinnedpeercertsha256
-          run-xray-tls-ping-against-a-remote-server-and-return-its-live-leaf-certificate-sha-256-hashes-for-pinning-pinnedpeercertsha256
+      - content: Fetch the fully aggregated inbound_client_ips database table. Used by
      - content: >-
          Fetch the fully aggregated inbound_client_ips database table. Used by
          nodes to sync recently active IPs across the cluster.
-        id: >-
+        id: fetch-the-fully-aggregated-inbound_client_ips-database-table-used-by-nodes-to-sync-recently-active-ips-across-the-cluster
-          fetch-the-fully-aggregated-inbound_client_ips-database-table-used-by-nodes-to-sync-recently-active-ips-across-the-cluster
+      - content: Submit a list of recently active IP timestamps. The panel merges them
      - content: >-
          Submit a list of recently active IP timestamps. The panel merges them
          with the existing database to maintain a unified global IP-limit view.
-        id: >-
+        id: submit-a-list-of-recently-active-ip-timestamps-the-panel-merges-them-with-the-existing-database-to-maintain-a-unified-global-ip-limit-view
          submit-a-list-of-recently-active-ip-timestamps-the-panel-merges-them-with-the-existing-database-to-maintain-a-unified-global-ip-limit-view
    contents: []
 ---
@@ -1,7 +1,6 @@
 ---
 title: Settings
-description: >-
+description: Panel configuration and user credentials. All endpoints live under
  Panel configuration and user credentials. All endpoints live under
  /panel/api/setting and require a logged-in session or Bearer token.
 full: true
 _openapi:
@@ -9,101 +8,69 @@ _openapi:
    - ./public/openapi.json
  toc:
    - depth: 2
-      title: >-
+      title: 'Return every panel setting: web server, Telegram bot, subscription,
-        Return every panel setting: web server, Telegram bot, subscription,
+        security, LDAP. The full JSON blob that the Settings page edits.'
-        security, LDAP. The full JSON blob that the Settings page edits.
+      url: '#return-every-panel-setting-web-server-telegram-bot-subscription-security-ldap-the-full-json-blob-that-the-settings-page-edits'
      url: >-
        #return-every-panel-setting-web-server-telegram-bot-subscription-security-ldap-the-full-json-blob-that-the-settings-page-edits
    - depth: 2
-      title: >-
+      title: Return the computed default settings based on the request host. Useful to
-        Return the computed default settings based on the request host. Useful
+        preview what a fresh install would use.
-        to preview what a fresh install would use.
+      url: '#return-the-computed-default-settings-based-on-the-request-host-useful-to-preview-what-a-fresh-install-would-use'
      url: >-
        #return-the-computed-default-settings-based-on-the-request-host-useful-to-preview-what-a-fresh-install-would-use
    - depth: 2
-      title: >-
+      title: Persist every setting at once. The body mirrors the shape returned by
        Persist every setting at once. The body mirrors the shape returned by
        /all. Invalid values (bad ports, missing cert pairs, etc.) are rejected
        before write.
-      url: >-
+      url: '#persist-every-setting-at-once-the-body-mirrors-the-shape-returned-by-all-invalid-values-bad-ports-missing-cert-pairs-etc-are-rejected-before-write'
        #persist-every-setting-at-once-the-body-mirrors-the-shape-returned-by-all-invalid-values-bad-ports-missing-cert-pairs-etc-are-rejected-before-write
    - depth: 2
-      title: >-
+      title: Change the panel admin username and password. Requires the current
        Change the panel admin username and password. Requires the current
        credentials for verification. The session is refreshed with the new
        values on success.
-      url: >-
+      url: '#change-the-panel-admin-username-and-password-requires-the-current-credentials-for-verification-the-session-is-refreshed-with-the-new-values-on-success'
        #change-the-panel-admin-username-and-password-requires-the-current-credentials-for-verification-the-session-is-refreshed-with-the-new-values-on-success
    - depth: 2
-      title: >-
+      title: Restart the entire 3x-ui process after a 3-second grace period. The
        Restart the entire 3x-ui process after a 3-second grace period. The
        connection drops immediately; the panel comes back online ~5-10 seconds
        later.
-      url: >-
+      url: '#restart-the-entire-3x-ui-process-after-a-3-second-grace-period-the-connection-drops-immediately-the-panel-comes-back-online-5-10-seconds-later'
        #restart-the-entire-3x-ui-process-after-a-3-second-grace-period-the-connection-drops-immediately-the-panel-comes-back-online-5-10-seconds-later
    - depth: 2
-      title: >-
+      title: Test SMTP connection with stage-by-stage reporting (connect, auth, send).
-        Test SMTP connection with stage-by-stage reporting (connect, auth,
+        Returns structured result with stage and message.
-        send). Returns structured result with stage and message.
+      url: '#test-smtp-connection-with-stage-by-stage-reporting-connect-auth-send-returns-structured-result-with-stage-and-message'
      url: >-
        #test-smtp-connection-with-stage-by-stage-reporting-connect-auth-send-returns-structured-result-with-stage-and-message
    - depth: 2
-      title: >-
+      title: Test Telegram bot connection by sending a test message to the configured
        Test Telegram bot connection by sending a test message to the configured
        chat.
-      url: >-
+      url: '#test-telegram-bot-connection-by-sending-a-test-message-to-the-configured-chat'
        #test-telegram-bot-connection-by-sending-a-test-message-to-the-configured-chat
    - depth: 2
-      title: >-
+      title: Return the built-in default Xray JSON config template that ships with
        Return the built-in default Xray JSON config template that ships with
        this panel version.
-      url: >-
+      url: '#return-the-built-in-default-xray-json-config-template-that-ships-with-this-panel-version'
        #return-the-built-in-default-xray-json-config-template-that-ships-with-this-panel-version
  structuredData:
    headings:
-      - content: >-
+      - content: 'Return every panel setting: web server, Telegram bot, subscription,
-          Return every panel setting: web server, Telegram bot, subscription,
+          security, LDAP. The full JSON blob that the Settings page edits.'
-          security, LDAP. The full JSON blob that the Settings page edits.
+        id: return-every-panel-setting-web-server-telegram-bot-subscription-security-ldap-the-full-json-blob-that-the-settings-page-edits
-        id: >-
+      - content: Return the computed default settings based on the request host. Useful
          return-every-panel-setting-web-server-telegram-bot-subscription-security-ldap-the-full-json-blob-that-the-settings-page-edits
      - content: >-
          Return the computed default settings based on the request host. Useful
          to preview what a fresh install would use.
-        id: >-
+        id: return-the-computed-default-settings-based-on-the-request-host-useful-to-preview-what-a-fresh-install-would-use
-          return-the-computed-default-settings-based-on-the-request-host-useful-to-preview-what-a-fresh-install-would-use
+      - content: Persist every setting at once. The body mirrors the shape returned by
      - content: >-
          Persist every setting at once. The body mirrors the shape returned by
          /all. Invalid values (bad ports, missing cert pairs, etc.) are
          rejected before write.
-        id: >-
+        id: persist-every-setting-at-once-the-body-mirrors-the-shape-returned-by-all-invalid-values-bad-ports-missing-cert-pairs-etc-are-rejected-before-write
-          persist-every-setting-at-once-the-body-mirrors-the-shape-returned-by-all-invalid-values-bad-ports-missing-cert-pairs-etc-are-rejected-before-write
+      - content: Change the panel admin username and password. Requires the current
      - content: >-
          Change the panel admin username and password. Requires the current
          credentials for verification. The session is refreshed with the new
          values on success.
-        id: >-
+        id: change-the-panel-admin-username-and-password-requires-the-current-credentials-for-verification-the-session-is-refreshed-with-the-new-values-on-success
-          change-the-panel-admin-username-and-password-requires-the-current-credentials-for-verification-the-session-is-refreshed-with-the-new-values-on-success
+      - content: Restart the entire 3x-ui process after a 3-second grace period. The
      - content: >-
          Restart the entire 3x-ui process after a 3-second grace period. The
          connection drops immediately; the panel comes back online ~5-10
          seconds later.
-        id: >-
+        id: restart-the-entire-3x-ui-process-after-a-3-second-grace-period-the-connection-drops-immediately-the-panel-comes-back-online-5-10-seconds-later
-          restart-the-entire-3x-ui-process-after-a-3-second-grace-period-the-connection-drops-immediately-the-panel-comes-back-online-5-10-seconds-later
+      - content: Test SMTP connection with stage-by-stage reporting (connect, auth,
      - content: >-
          Test SMTP connection with stage-by-stage reporting (connect, auth,
          send). Returns structured result with stage and message.
-        id: >-
+        id: test-smtp-connection-with-stage-by-stage-reporting-connect-auth-send-returns-structured-result-with-stage-and-message
-          test-smtp-connection-with-stage-by-stage-reporting-connect-auth-send-returns-structured-result-with-stage-and-message
+      - content: Test Telegram bot connection by sending a test message to the
      - content: >-
          Test Telegram bot connection by sending a test message to the
          configured chat.
-        id: >-
+        id: test-telegram-bot-connection-by-sending-a-test-message-to-the-configured-chat
-          test-telegram-bot-connection-by-sending-a-test-message-to-the-configured-chat
+      - content: Return the built-in default Xray JSON config template that ships with
      - content: >-
          Return the built-in default Xray JSON config template that ships with
          this panel version.
-        id: >-
+        id: return-the-built-in-default-xray-json-config-template-that-ships-with-this-panel-version
          return-the-built-in-default-xray-json-config-template-that-ships-with-this-panel-version
    contents: []
 ---
@@ -1,59 +1,46 @@
 ---
 title: Subscription Server
-description: >-
+description: A separate HTTP/HTTPS server that serves proxy subscription links
-  A separate HTTP/HTTPS server that serves proxy subscription links (standard,
+  (standard, JSON, and Clash) to clients. The server listens on its own port
-  JSON, and Clash) to clients. The server listens on its own port (default
+  (default 10882) and is configured in Settings → Subscription. Paths are
-  10882) and is configured in Settings → Subscription. Paths are configurable;
+  configurable; defaults are shown below. All subscription endpoints set
-  defaults are shown below. All subscription endpoints set response headers for
+  response headers for client apps to read traffic/expiry info.
  client apps to read traffic/expiry info.
 full: true
 _openapi:
  preload:
    - ./public/openapi.json
  toc:
    - depth: 2
-      title: >-
+      title: 'Return base64-encoded subscription links for all enabled clients
        Return base64-encoded subscription links for all enabled clients
        matching the subscription ID. When the request has an Accept: text/html
        header or ?html=1, renders a styled info page instead. Default path:
-        /sub/:subid.
+        /sub/:subid.'
-      url: >-
+      url: '#return-base64-encoded-subscription-links-for-all-enabled-clients-matching-the-subscription-id-when-the-request-has-an-accept-texthtml-header-or-html1-renders-a-styled-info-page-instead-default-path-subsubid'
        #return-base64-encoded-subscription-links-for-all-enabled-clients-matching-the-subscription-id-when-the-request-has-an-accept-texthtml-header-or-html1-renders-a-styled-info-page-instead-default-path-subsubid
    - depth: 2
-      title: >-
+      title: 'Return subscription as a JSON array of proxy configs (one per enabled
        Return subscription as a JSON array of proxy configs (one per enabled
        client). Only when JSON subscription is enabled in settings. Default
-        path: /json/:subid.
+        path: /json/:subid.'
-      url: >-
+      url: '#return-subscription-as-a-json-array-of-proxy-configs-one-per-enabled-client-only-when-json-subscription-is-enabled-in-settings-default-path-jsonsubid'
        #return-subscription-as-a-json-array-of-proxy-configs-one-per-enabled-client-only-when-json-subscription-is-enabled-in-settings-default-path-jsonsubid
    - depth: 2
-      title: >-
+      title: 'Return subscription as a Clash/Mihomo-compatible YAML config, including
        Return subscription as a Clash/Mihomo-compatible YAML config, including
        configured global Clash routing rules. Only when Clash subscription is
-        enabled in settings. Default path: /clash/:subid.
+        enabled in settings. Default path: /clash/:subid.'
-      url: >-
+      url: '#return-subscription-as-a-clashmihomo-compatible-yaml-config-including-configured-global-clash-routing-rules-only-when-clash-subscription-is-enabled-in-settings-default-path-clashsubid'
        #return-subscription-as-a-clashmihomo-compatible-yaml-config-including-configured-global-clash-routing-rules-only-when-clash-subscription-is-enabled-in-settings-default-path-clashsubid
  structuredData:
    headings:
-      - content: >-
+      - content: 'Return base64-encoded subscription links for all enabled clients
          Return base64-encoded subscription links for all enabled clients
          matching the subscription ID. When the request has an Accept:
          text/html header or ?html=1, renders a styled info page instead.
-          Default path: /sub/:subid.
+          Default path: /sub/:subid.'
-        id: >-
+        id: return-base64-encoded-subscription-links-for-all-enabled-clients-matching-the-subscription-id-when-the-request-has-an-accept-texthtml-header-or-html1-renders-a-styled-info-page-instead-default-path-subsubid
-          return-base64-encoded-subscription-links-for-all-enabled-clients-matching-the-subscription-id-when-the-request-has-an-accept-texthtml-header-or-html1-renders-a-styled-info-page-instead-default-path-subsubid
+      - content: 'Return subscription as a JSON array of proxy configs (one per enabled
      - content: >-
          Return subscription as a JSON array of proxy configs (one per enabled
          client). Only when JSON subscription is enabled in settings. Default
-          path: /json/:subid.
+          path: /json/:subid.'
-        id: >-
+        id: return-subscription-as-a-json-array-of-proxy-configs-one-per-enabled-client-only-when-json-subscription-is-enabled-in-settings-default-path-jsonsubid
-          return-subscription-as-a-json-array-of-proxy-configs-one-per-enabled-client-only-when-json-subscription-is-enabled-in-settings-default-path-jsonsubid
+      - content: 'Return subscription as a Clash/Mihomo-compatible YAML config,
      - content: >-
          Return subscription as a Clash/Mihomo-compatible YAML config,
          including configured global Clash routing rules. Only when Clash
-          subscription is enabled in settings. Default path: /clash/:subid.
+          subscription is enabled in settings. Default path: /clash/:subid.'
-        id: >-
+        id: return-subscription-as-a-clashmihomo-compatible-yaml-config-including-configured-global-clash-routing-rules-only-when-clash-subscription-is-enabled-in-settings-default-path-clashsubid
          return-subscription-as-a-clashmihomo-compatible-yaml-config-including-configured-global-clash-routing-rules-only-when-clash-subscription-is-enabled-in-settings-default-path-clashsubid
    contents: []
 ---
@@ -1,7 +1,6 @@
 ---
 title: WebSocket
-description: >-
+description: Real-time status updates via WebSocket. Connect once at
  Real-time status updates via WebSocket. Connect once at
  <code>ws://<panel>/ws</code> to receive a stream of JSON messages without
  polling. Requires an authenticated session cookie (Bearer token auth is not
  supported). Each message has a <code>type</code> field that identifies the
@@ -12,22 +11,18 @@ _openapi:
    - ./public/openapi.json
  toc:
    - depth: 2
-      title: >-
+      title: Upgrade an HTTP connection to a WebSocket. Requires an authenticated
        Upgrade an HTTP connection to a WebSocket. Requires an authenticated
        session cookie (Bearer token auth is not supported here). Returns 101
        Switching Protocols on success. The server then pushes JSON messages
        described below.
-      url: >-
+      url: '#upgrade-an-http-connection-to-a-websocket-requires-an-authenticated-session-cookie-bearer-token-auth-is-not-supported-here-returns-101-switching-protocols-on-success-the-server-then-pushes-json-messages-described-below'
        #upgrade-an-http-connection-to-a-websocket-requires-an-authenticated-session-cookie-bearer-token-auth-is-not-supported-here-returns-101-switching-protocols-on-success-the-server-then-pushes-json-messages-described-below
  structuredData:
    headings:
-      - content: >-
+      - content: Upgrade an HTTP connection to a WebSocket. Requires an authenticated
          Upgrade an HTTP connection to a WebSocket. Requires an authenticated
          session cookie (Bearer token auth is not supported here). Returns 101
          Switching Protocols on success. The server then pushes JSON messages
          described below.
-        id: >-
+        id: upgrade-an-http-connection-to-a-websocket-requires-an-authenticated-session-cookie-bearer-token-auth-is-not-supported-here-returns-101-switching-protocols-on-success-the-server-then-pushes-json-messages-described-below
          upgrade-an-http-connection-to-a-websocket-requires-an-authenticated-session-cookie-bearer-token-auth-is-not-supported-here-returns-101-switching-protocols-on-success-the-server-then-pushes-json-messages-described-below
    contents: []
 ---
@@ -1,50 +1,37 @@
 ---
 title: Xray Settings
-description: >-
+description: Xray configuration template, outbound management, Warp/Nord
-  Xray configuration template, outbound management, Warp/Nord integration, and
+  integration, and config testing. All endpoints under /panel/api/xray.
  config testing. All endpoints under /panel/api/xray.
 full: true
 _openapi:
  preload:
    - ./public/openapi.json
  toc:
    - depth: 2
-      title: >-
+      title: Return the Xray config template (JSON string), available inbound tags,
        Return the Xray config template (JSON string), available inbound tags,
        client reverse tags, and the configured outbound test URL in one
        response.
-      url: >-
+      url: '#return-the-xray-config-template-json-string-available-inbound-tags-client-reverse-tags-and-the-configured-outbound-test-url-in-one-response'
        #return-the-xray-config-template-json-string-available-inbound-tags-client-reverse-tags-and-the-configured-outbound-test-url-in-one-response
    - depth: 2
-      title: >-
+      title: Return the built-in default Xray config shipped with the panel (identical
-        Return the built-in default Xray config shipped with the panel
+        to /panel/api/setting/getDefaultJsonConfig).
-        (identical to /panel/api/setting/getDefaultJsonConfig).
+      url: '#return-the-built-in-default-xray-config-shipped-with-the-panel-identical-to-panelapisettinggetdefaultjsonconfig'
      url: >-
        #return-the-built-in-default-xray-config-shipped-with-the-panel-identical-to-panelapisettinggetdefaultjsonconfig
    - depth: 2
-      title: >-
+      title: Return traffic statistics for every outbound. Each outbound shows
        Return traffic statistics for every outbound. Each outbound shows
        up/down/total counters.
-      url: >-
+      url: '#return-traffic-statistics-for-every-outbound-each-outbound-shows-updowntotal-counters'
        #return-traffic-statistics-for-every-outbound-each-outbound-shows-updowntotal-counters
    - depth: 2
-      title: >-
+      title: Return the most recent Xray process stdout/stderr output. Useful to check
-        Return the most recent Xray process stdout/stderr output. Useful to
+        for startup errors or runtime warnings.
-        check for startup errors or runtime warnings.
+      url: '#return-the-most-recent-xray-process-stdoutstderr-output-useful-to-check-for-startup-errors-or-runtime-warnings'
      url: >-
        #return-the-most-recent-xray-process-stdoutstderr-output-useful-to-check-for-startup-errors-or-runtime-warnings
    - depth: 2
-      title: >-
+      title: Save the Xray JSON config template and optionally the outbound test URL.
        Save the Xray JSON config template and optionally the outbound test URL.
        Both are sent as form fields.
-      url: >-
+      url: '#save-the-xray-json-config-template-and-optionally-the-outbound-test-url-both-are-sent-as-form-fields'
        #save-the-xray-json-config-template-and-optionally-the-outbound-test-url-both-are-sent-as-form-fields
    - depth: 2
-      title: >-
+      title: Manage Cloudflare Warp integration. The action parameter selects the
        Manage Cloudflare Warp integration. The action parameter selects the
        operation.
-      url: >-
+      url: '#manage-cloudflare-warp-integration-the-action-parameter-selects-the-operation'
        #manage-cloudflare-warp-integration-the-action-parameter-selects-the-operation
    - depth: 2
      title: Manage NordVPN integration. The action parameter selects the operation.
      url: '#manage-nordvpn-integration-the-action-parameter-selects-the-operation'
@@ -52,193 +39,130 @@ _openapi:
      title: Reset traffic counters for a specific outbound by tag.
      url: '#reset-traffic-counters-for-a-specific-outbound-by-tag'
    - depth: 2
-      title: >-
+      title: Test an outbound configuration. Sends the outbound JSON (required),
        Test an outbound configuration. Sends the outbound JSON (required),
        optionally all outbounds (to resolve sockopt.dialerProxy dependencies),
        and a mode flag.
-      url: >-
+      url: '#test-an-outbound-configuration-sends-the-outbound-json-required-optionally-all-outbounds-to-resolve-sockoptdialerproxy-dependencies-and-a-mode-flag'
        #test-an-outbound-configuration-sends-the-outbound-json-required-optionally-all-outbounds-to-resolve-sockoptdialerproxy-dependencies-and-a-mode-flag
    - depth: 2
-      title: >-
+      title: Test a batch of outbounds (max 50) through one shared temp xray instance.
-        Test a batch of outbounds (max 50) through one shared temp xray
+        Returns an array of results in input order, each with the outbound tag,
-        instance. Returns an array of results in input order, each with the
+        delay, HTTP status and a connect/TLS/TTFB timing breakdown.
-        outbound tag, delay, HTTP status and a connect/TLS/TTFB timing
+      url: '#test-a-batch-of-outbounds-max-50-through-one-shared-temp-xray-instance-returns-an-array-of-results-in-input-order-each-with-the-outbound-tag-delay-http-status-and-a-connecttlsttfb-timing-breakdown'
        breakdown.
      url: >-
        #test-a-batch-of-outbounds-max-50-through-one-shared-temp-xray-instance-returns-an-array-of-results-in-input-order-each-with-the-outbound-tag-delay-http-status-and-a-connecttlsttfb-timing-breakdown
    - depth: 2
-      title: >-
+      title: 'Live state of routing balancers in the running core
        Live state of routing balancers in the running core
        (RoutingService.GetBalancerInfo): current override and the targets the
-        strategy prefers. Returns a map keyed by balancer tag.
+        strategy prefers. Returns a map keyed by balancer tag.'
-      url: >-
+      url: '#live-state-of-routing-balancers-in-the-running-core-routingservicegetbalancerinfo-current-override-and-the-targets-the-strategy-prefers-returns-a-map-keyed-by-balancer-tag'
        #live-state-of-routing-balancers-in-the-running-core-routingservicegetbalancerinfo-current-override-and-the-targets-the-strategy-prefers-returns-a-map-keyed-by-balancer-tag
    - depth: 2
-      title: >-
+      title: Force a balancer in the running core to always pick one outbound
        Force a balancer in the running core to always pick one outbound
        (RoutingService.OverrideBalancerTarget). Applied live without a restart;
        cleared automatically when Xray restarts.
-      url: >-
+      url: '#force-a-balancer-in-the-running-core-to-always-pick-one-outbound-routingserviceoverridebalancertarget-applied-live-without-a-restart-cleared-automatically-when-xray-restarts'
        #force-a-balancer-in-the-running-core-to-always-pick-one-outbound-routingserviceoverridebalancertarget-applied-live-without-a-restart-cleared-automatically-when-xray-restarts
    - depth: 2
-      title: >-
+      title: Ask the running core which outbound its router would pick for a synthetic
-        Ask the running core which outbound its router would pick for a
+        connection (RoutingService.TestRoute). No traffic is sent.
-        synthetic connection (RoutingService.TestRoute). No traffic is sent.
+      url: '#ask-the-running-core-which-outbound-its-router-would-pick-for-a-synthetic-connection-routingservicetestroute-no-traffic-is-sent'
      url: >-
        #ask-the-running-core-which-outbound-its-router-would-pick-for-a-synthetic-connection-routingservicetestroute-no-traffic-is-sent
    - depth: 2
-      title: >-
+      title: List all outbound subscriptions (remote URLs that supply additional
        List all outbound subscriptions (remote URLs that supply additional
        outbounds), newest first.
-      url: >-
+      url: '#list-all-outbound-subscriptions-remote-urls-that-supply-additional-outbounds-newest-first'
        #list-all-outbound-subscriptions-remote-urls-that-supply-additional-outbounds-newest-first
    - depth: 2
-      title: >-
+      title: Create an outbound subscription. The URL is fetched, parsed into
        Create an outbound subscription. The URL is fetched, parsed into
        outbounds with stable tags, and merged additively into the running Xray
        config.
-      url: >-
+      url: '#create-an-outbound-subscription-the-url-is-fetched-parsed-into-outbounds-with-stable-tags-and-merged-additively-into-the-running-xray-config'
        #create-an-outbound-subscription-the-url-is-fetched-parsed-into-outbounds-with-stable-tags-and-merged-additively-into-the-running-xray-config
    - depth: 2
-      title: >-
+      title: Update an existing outbound subscription by id. Accepts the same form
        Update an existing outbound subscription by id. Accepts the same form
        fields as create.
-      url: >-
+      url: '#update-an-existing-outbound-subscription-by-id-accepts-the-same-form-fields-as-create'
        #update-an-existing-outbound-subscription-by-id-accepts-the-same-form-fields-as-create
    - depth: 2
      title: Delete an outbound subscription by id.
      url: '#delete-an-outbound-subscription-by-id'
    - depth: 2
-      title: >-
+      title: Delete an outbound subscription by id (POST alias of DELETE for
        Delete an outbound subscription by id (POST alias of DELETE for
        axios-friendly clients).
-      url: >-
+      url: '#delete-an-outbound-subscription-by-id-post-alias-of-delete-for-axios-friendly-clients'
        #delete-an-outbound-subscription-by-id-post-alias-of-delete-for-axios-friendly-clients
    - depth: 2
-      title: >-
+      title: Force an immediate re-fetch of the subscription and return the parsed
        Force an immediate re-fetch of the subscription and return the parsed
        outbounds. Signals Xray to reload.
-      url: >-
+      url: '#force-an-immediate-re-fetch-of-the-subscription-and-return-the-parsed-outbounds-signals-xray-to-reload'
        #force-an-immediate-re-fetch-of-the-subscription-and-return-the-parsed-outbounds-signals-xray-to-reload
    - depth: 2
-      title: >-
+      title: Reorder a subscription one step up or down in priority (controls its
        Reorder a subscription one step up or down in priority (controls its
        position in the merged outbounds).
-      url: >-
+      url: '#reorder-a-subscription-one-step-up-or-down-in-priority-controls-its-position-in-the-merged-outbounds'
        #reorder-a-subscription-one-step-up-or-down-in-priority-controls-its-position-in-the-merged-outbounds
    - depth: 2
-      title: >-
+      title: 'Preview a subscription URL: fetch and parse it into outbounds without
-        Preview a subscription URL: fetch and parse it into outbounds without
+        persisting anything.'
-        persisting anything.
+      url: '#preview-a-subscription-url-fetch-and-parse-it-into-outbounds-without-persisting-anything'
      url: >-
        #preview-a-subscription-url-fetch-and-parse-it-into-outbounds-without-persisting-anything
  structuredData:
    headings:
-      - content: >-
+      - content: Return the Xray config template (JSON string), available inbound tags,
          Return the Xray config template (JSON string), available inbound tags,
          client reverse tags, and the configured outbound test URL in one
          response.
-        id: >-
+        id: return-the-xray-config-template-json-string-available-inbound-tags-client-reverse-tags-and-the-configured-outbound-test-url-in-one-response
-          return-the-xray-config-template-json-string-available-inbound-tags-client-reverse-tags-and-the-configured-outbound-test-url-in-one-response
+      - content: Return the built-in default Xray config shipped with the panel
      - content: >-
          Return the built-in default Xray config shipped with the panel
          (identical to /panel/api/setting/getDefaultJsonConfig).
-        id: >-
+        id: return-the-built-in-default-xray-config-shipped-with-the-panel-identical-to-panelapisettinggetdefaultjsonconfig
-          return-the-built-in-default-xray-config-shipped-with-the-panel-identical-to-panelapisettinggetdefaultjsonconfig
+      - content: Return traffic statistics for every outbound. Each outbound shows
      - content: >-
          Return traffic statistics for every outbound. Each outbound shows
          up/down/total counters.
-        id: >-
+        id: return-traffic-statistics-for-every-outbound-each-outbound-shows-updowntotal-counters
-          return-traffic-statistics-for-every-outbound-each-outbound-shows-updowntotal-counters
+      - content: Return the most recent Xray process stdout/stderr output. Useful to
      - content: >-
          Return the most recent Xray process stdout/stderr output. Useful to
          check for startup errors or runtime warnings.
-        id: >-
+        id: return-the-most-recent-xray-process-stdoutstderr-output-useful-to-check-for-startup-errors-or-runtime-warnings
-          return-the-most-recent-xray-process-stdoutstderr-output-useful-to-check-for-startup-errors-or-runtime-warnings
+      - content: Save the Xray JSON config template and optionally the outbound test
      - content: >-
          Save the Xray JSON config template and optionally the outbound test
          URL. Both are sent as form fields.
-        id: >-
+        id: save-the-xray-json-config-template-and-optionally-the-outbound-test-url-both-are-sent-as-form-fields
-          save-the-xray-json-config-template-and-optionally-the-outbound-test-url-both-are-sent-as-form-fields
+      - content: Manage Cloudflare Warp integration. The action parameter selects the
      - content: >-
          Manage Cloudflare Warp integration. The action parameter selects the
          operation.
        id: >-
          manage-cloudflare-warp-integration-the-action-parameter-selects-the-operation
      - content: >-
          Manage NordVPN integration. The action parameter selects the
          operation.
        id: manage-cloudflare-warp-integration-the-action-parameter-selects-the-operation
      - content: Manage NordVPN integration. The action parameter selects the operation.
        id: manage-nordvpn-integration-the-action-parameter-selects-the-operation
      - content: Reset traffic counters for a specific outbound by tag.
        id: reset-traffic-counters-for-a-specific-outbound-by-tag
-      - content: >-
+      - content: Test an outbound configuration. Sends the outbound JSON (required),
          Test an outbound configuration. Sends the outbound JSON (required),
          optionally all outbounds (to resolve sockopt.dialerProxy
          dependencies), and a mode flag.
-        id: >-
+        id: test-an-outbound-configuration-sends-the-outbound-json-required-optionally-all-outbounds-to-resolve-sockoptdialerproxy-dependencies-and-a-mode-flag
-          test-an-outbound-configuration-sends-the-outbound-json-required-optionally-all-outbounds-to-resolve-sockoptdialerproxy-dependencies-and-a-mode-flag
+      - content: Test a batch of outbounds (max 50) through one shared temp xray
      - content: >-
          Test a batch of outbounds (max 50) through one shared temp xray
          instance. Returns an array of results in input order, each with the
          outbound tag, delay, HTTP status and a connect/TLS/TTFB timing
          breakdown.
-        id: >-
+        id: test-a-batch-of-outbounds-max-50-through-one-shared-temp-xray-instance-returns-an-array-of-results-in-input-order-each-with-the-outbound-tag-delay-http-status-and-a-connecttlsttfb-timing-breakdown
-          test-a-batch-of-outbounds-max-50-through-one-shared-temp-xray-instance-returns-an-array-of-results-in-input-order-each-with-the-outbound-tag-delay-http-status-and-a-connecttlsttfb-timing-breakdown
+      - content: 'Live state of routing balancers in the running core
      - content: >-
          Live state of routing balancers in the running core
          (RoutingService.GetBalancerInfo): current override and the targets the
-          strategy prefers. Returns a map keyed by balancer tag.
+          strategy prefers. Returns a map keyed by balancer tag.'
-        id: >-
+        id: live-state-of-routing-balancers-in-the-running-core-routingservicegetbalancerinfo-current-override-and-the-targets-the-strategy-prefers-returns-a-map-keyed-by-balancer-tag
-          live-state-of-routing-balancers-in-the-running-core-routingservicegetbalancerinfo-current-override-and-the-targets-the-strategy-prefers-returns-a-map-keyed-by-balancer-tag
+      - content: Force a balancer in the running core to always pick one outbound
      - content: >-
          Force a balancer in the running core to always pick one outbound
          (RoutingService.OverrideBalancerTarget). Applied live without a
          restart; cleared automatically when Xray restarts.
-        id: >-
+        id: force-a-balancer-in-the-running-core-to-always-pick-one-outbound-routingserviceoverridebalancertarget-applied-live-without-a-restart-cleared-automatically-when-xray-restarts
-          force-a-balancer-in-the-running-core-to-always-pick-one-outbound-routingserviceoverridebalancertarget-applied-live-without-a-restart-cleared-automatically-when-xray-restarts
+      - content: Ask the running core which outbound its router would pick for a
      - content: >-
          Ask the running core which outbound its router would pick for a
          synthetic connection (RoutingService.TestRoute). No traffic is sent.
-        id: >-
+        id: ask-the-running-core-which-outbound-its-router-would-pick-for-a-synthetic-connection-routingservicetestroute-no-traffic-is-sent
-          ask-the-running-core-which-outbound-its-router-would-pick-for-a-synthetic-connection-routingservicetestroute-no-traffic-is-sent
+      - content: List all outbound subscriptions (remote URLs that supply additional
      - content: >-
          List all outbound subscriptions (remote URLs that supply additional
          outbounds), newest first.
-        id: >-
+        id: list-all-outbound-subscriptions-remote-urls-that-supply-additional-outbounds-newest-first
-          list-all-outbound-subscriptions-remote-urls-that-supply-additional-outbounds-newest-first
+      - content: Create an outbound subscription. The URL is fetched, parsed into
      - content: >-
          Create an outbound subscription. The URL is fetched, parsed into
          outbounds with stable tags, and merged additively into the running
          Xray config.
-        id: >-
+        id: create-an-outbound-subscription-the-url-is-fetched-parsed-into-outbounds-with-stable-tags-and-merged-additively-into-the-running-xray-config
-          create-an-outbound-subscription-the-url-is-fetched-parsed-into-outbounds-with-stable-tags-and-merged-additively-into-the-running-xray-config
+      - content: Update an existing outbound subscription by id. Accepts the same form
      - content: >-
          Update an existing outbound subscription by id. Accepts the same form
          fields as create.
-        id: >-
+        id: update-an-existing-outbound-subscription-by-id-accepts-the-same-form-fields-as-create
          update-an-existing-outbound-subscription-by-id-accepts-the-same-form-fields-as-create
      - content: Delete an outbound subscription by id.
        id: delete-an-outbound-subscription-by-id
-      - content: >-
+      - content: Delete an outbound subscription by id (POST alias of DELETE for
          Delete an outbound subscription by id (POST alias of DELETE for
          axios-friendly clients).
-        id: >-
+        id: delete-an-outbound-subscription-by-id-post-alias-of-delete-for-axios-friendly-clients
-          delete-an-outbound-subscription-by-id-post-alias-of-delete-for-axios-friendly-clients
+      - content: Force an immediate re-fetch of the subscription and return the parsed
      - content: >-
          Force an immediate re-fetch of the subscription and return the parsed
          outbounds. Signals Xray to reload.
-        id: >-
+        id: force-an-immediate-re-fetch-of-the-subscription-and-return-the-parsed-outbounds-signals-xray-to-reload
-          force-an-immediate-re-fetch-of-the-subscription-and-return-the-parsed-outbounds-signals-xray-to-reload
+      - content: Reorder a subscription one step up or down in priority (controls its
      - content: >-
          Reorder a subscription one step up or down in priority (controls its
          position in the merged outbounds).
-        id: >-
+        id: reorder-a-subscription-one-step-up-or-down-in-priority-controls-its-position-in-the-merged-outbounds
-          reorder-a-subscription-one-step-up-or-down-in-priority-controls-its-position-in-the-merged-outbounds
+      - content: 'Preview a subscription URL: fetch and parse it into outbounds without
-      - content: >-
+          persisting anything.'
-          Preview a subscription URL: fetch and parse it into outbounds without
+        id: preview-a-subscription-url-fetch-and-parse-it-into-outbounds-without-persisting-anything
          persisting anything.
        id: >-
          preview-a-subscription-url-fetch-and-parse-it-into-outbounds-without-persisting-anything
    contents: []
 ---
@@ -18,21 +18,20 @@
    "test:watch": "vitest"
  },
  "dependencies": {
-    "@orama/orama": "^3.1.18",
+    "fumadocs-core": "^16.14.5",
    "fumadocs-core": "^16.14.3",
    "fumadocs-docgen": "^3.1.0",
-    "fumadocs-mdx": "^15.2.3",
+    "fumadocs-mdx": "^15.3.0",
-    "fumadocs-openapi": "^11.2.3",
+    "fumadocs-openapi": "^11.2.4",
-    "fumadocs-ui": "^16.14.3",
+    "fumadocs-ui": "^16.14.5",
-    "lucide-react": "^1.31.0",
+    "lucide-react": "^1.33.0",
-    "mermaid": "^11.16.1",
+    "mermaid": "^11.17.0",
-    "next": "16.3.0",
+    "next": "16.3.1",
    "next-themes": "^0.4.6",
    "react": "^19.2.8",
    "react-dom": "^19.2.8",
    "react-qr-code": "^2.2.0",
    "tailwind-merge": "^3.6.0",
-    "zbsearch": "3.3.4",
+    "zbsearch": "4.0.0",
    "zod": "^4.4.3"
  },
  "devDependencies": {
@@ -41,12 +40,12 @@
    "@types/node": "^26.2.0",
    "@types/react": "^19.2.18",
    "@types/react-dom": "^19.2.4",
-    "oxfmt": "0.63.0",
+    "oxfmt": "0.64.0",
-    "oxlint": "1.78.0",
+    "oxlint": "1.79.0",
    "postcss": "^8.5.26",
    "tailwindcss": "^4.3.3",
    "typescript": "7.0.2",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.11"
  },
-  "packageManager": "pnpm@11.21.0+sha512.521705bce689924eac72f5a3587122f362689ef6571e55ba80076fd637c11132ecffada26fad4ea79c485bfddbfd3d5a2a5b05805a77e893de71ec8a6cca3bb1"
+  "packageManager": "pnpm@11.22.0+sha512.1ff870c4c6133dfd88fb2afc46dd13d47f09c9794b438c6fdb47ca98caf3bc16381ee0be93a091b8e3824cf01f889f46d7d9e20910fb0be1ab0fb5baa80dd621"
 }
@@ -8,9 +8,8 @@ overrides:
  'postcss@<8.5.10': '^8.5.15'
  'sharp@<0.35.0': '^0.35.3'
 minimumReleaseAgeExclude:
-  - '@mermaid-js/parser@1.2.0'
+  - '@mermaid-js/parser@1.2.1'
-  - mermaid@11.16.0
+  - mermaid@11.17.0
-  - fumadocs-core@16.14.1
+  - lucide-react@1.33.0
  - fumadocs-ui@16.14.1
  - lucide-react@1.29.0
  - postcss@8.5.26
  - fumadocs-mdx@15.3.0