Move to TypeScript 7 and the oxc toolchain (oxlint + oxfmt) (#6262)

* chore(frontend,docs): move to TypeScript 7 and replace ESLint with oxlint

TypeScript 7 is the native Go port and ships no programmatic compiler
API, so typescript-eslint cannot run at all: it peer-pins
typescript >=4.8.4 <6.1.0 (canary too) and hard-crashes with
"typescript-eslint does not support TS 7.0". Upstream support is
tracked in typescript-eslint#10940 and targets TS >=7.1.

Rather than wait, or carry Microsoft's side-by-side alias (which keeps
a second TS 6 install alive purely to feed the linter), both projects
move to oxlint, which never depended on the TypeScript API.

Typecheck drops from ~9.7s to ~2.2s and 167 packages leave frontend/.

oxlint has no no-restricted-syntax, so the #6121/#6127 cleared-
InputNumber guard is reimplemented as a JS plugin in
frontend/tools/oxlint/. It was verified to still fire in
pages/settings/** and pages/xray/** and to stay exempt in *Modal.tsx.

The type-aware @deprecated sweep survives too, as
`npm run lint:deprecated`: oxlint's type-aware mode runs on
oxlint-tsgolint, which drives the TS 7 typescript-go checker, so the
TS 7 move is what makes it possible.

Behaviour is preserved rather than tightened. jsx-a11y/prefer-tag-over-role
is off in both configs because it was never part of the recommended sets
ESLint actually ran, and oxlint honours the existing eslint-disable
comments, so no source churn was needed.

Two real fixes fell out of the stricter linting:
- outbound-link-parser.test.ts used `out?.streamSettings` behind an `as`
  cast, which hid the optional chain from ESLint and would throw on a
  null parse; the rest of the file already used `out!`.
- InputAddon's conditional role/tabIndex/onKeyDown is genuinely
  accessible but oxlint cannot evaluate it, so it gets a scoped disable.

* chore(docs): replace Prettier with oxfmt

oxfmt is the oxc project's Prettier-compatible formatter, so this pairs
with the oxlint move and drops the last JS-based tool from the docs
toolchain.

The swap is behaviour-preserving. Running Prettier and oxfmt over the
same files, with the existing .prettierrc.json settings migrated via
`oxfmt --migrate=prettier`, produces byte-identical output on every
file. (Comparing them outside the project directory is misleading:
Prettier silently falls back to its defaults when it cannot find its
config, which looks like a mismatch but is not one.)

The 18 files reformatted here were already failing `pnpm format:check`
before this change — Prettier wanted the exact same edits. The check is
not part of docs-ci.yml, which is why the drift went unnoticed.

.prettierignore becomes ignorePatterns in .oxfmtrc.json, keeping the
deliberate MDX exclusion: reflowing MDX prose merges headings into
paragraphs and collapses lists inside Steps/Callout components. Both
that and the generated fumadocs-openapi reference output were verified
untouched.

oxfmt is pinned to 0.63.0 rather than latest. pnpm 11's built-in
minimumReleaseAge policy rejects same-day releases, and 0.64.0 would
have made pnpm silently append 20 waiver lines to pnpm-workspace.yaml.

* style(frontend): adopt oxfmt and format src

frontend/ has never had a formatter, so this reformats 344 of 497 files
in src/. The change is purely whitespace, quoting and line wrapping —
no logic is touched. It is kept in its own commit so it does not bury
the TypeScript 7 / oxlint migration or the git blame for the code
itself.

Settings match docs/ and the code as it was already written: single
quotes, semicolons, trailing commas, 2-space indent, 100 columns. That
was measured rather than assumed — src/ was already uniformly
single-quoted and 2-space indented, with p90 line length at 75.

Formatting is scoped to src/ (mirroring `oxlint src`) and
.oxfmtrc.json ignores src/generated. Both matter: `make gen-check`
compares src/generated and public/openapi.json, and
`make msw-worker-check` byte-compares public/mockServiceWorker.js
against the installed MSW runtime, so reformatting any of them breaks
the gate.

Reflowing also moves `eslint-disable-next-line` comments off the line
they guard, which broke two suppressions that had been silently
correct before:
- clone-inbound-modal.test.tsx: the object literal became multi-line,
  leaving `} as any;` four lines below its no-explicit-any disable.
- ClientsPage.tsx: the useMemo dependency array moved onto its own
  line, out from under its exhaustive-deps disable.
Both comments were relocated onto the line they actually guard, and
verified to still suppress by removing them and watching the errors
return.

* ci: enforce formatting in CI and make verify

Adding oxfmt in the previous two commits gave both projects a formatter
but nothing that checks it, which is how docs/ had already drifted to 18
unformatted files: docs-ci.yml runs typecheck, lint, test and build, but
never format:check, so Prettier's complaints were only ever visible to
whoever ran it by hand.

Wire `format:check` into the frontend job in ci.yml and the docs job in
docs-ci.yml, and add a `format-check` target to `make verify` so the
local gate keeps mirroring CI as the Makefile header promises.

Verified the step actually bites rather than passing vacuously: adding
a badly formatted line to a source file in each project makes both
`make format-check` and `pnpm format:check` fail, and reverting it makes
them pass again.

No workflow referenced ESLint or Prettier by name — they all invoke the
package scripts — so the tooling swap needed no other CI changes.

* ci: trigger CI on Makefile changes

The path filters listed **.go, go.mod, go.sum, frontend/**, .nvmrc and
ci.yml itself, but not the Makefile — so a change to the canonical task
runner that ci.yml is meant to mirror could land without any job
running. The previous commit, which edits both, only triggers because
it happens to touch ci.yml too.

* fix(frontend): replace deprecated Ant Design 6 APIs in the geo components

`npm run lint:deprecated` reported five uses of props Ant Design 6 has
deprecated. All five are gone, and the matching runtime warnings no
longer appear in the test output.

Tag `bordered={false}` becomes `variant="filled"` and Space `direction`
becomes `orientation`; both are the one-to-one replacements named in
antd's own deprecation messages, and `direction`/`orientation` share the
same Orientation type.

Input `addonAfter` is the one that is not a rename. It becomes a
`Space.Compact block` wrapping the Input and the browse Button, which is
antd's documented migration. `block` keeps the field filling its form
row as the addon did. Note this is a deliberate visual change: the
button used to be a borderless `type="text"` icon sitting inside the
addon's grey box, and is now a regular button whose border joins the
input. The tooltip, aria-label, ref, id and onBlur wiring are unchanged,
so the react-hook-form binding in RuleFormModal and the existing tests
still address it the same way.

Only these five were deprecated. The other `bordered` props in the tree
sit on QRCode, Table, Descriptions and Alert, where the prop is not
deprecated, and these were the only two Space `direction` uses in the
codebase.

* fix(frontend): restore lint rules lost in the oxlint migration, and test the guard

Addresses the review on #6262.

The frontend config re-enabled only no-explicit-any and no-unused-vars
and left the rest of tseslint's recommended set to oxlint's correctness
category. It does not cover all of it. Confirmed by linting one probe
file against both configs: docs/ (which enumerates the rules) reports
all nine, frontend/ reported four. So ban-ts-comment,
no-empty-object-type, no-namespace, no-require-imports and
no-unsafe-function-type had silently stopped being enforced — a `//
@ts-ignore` or a `namespace` block would have landed unflagged. The ten
rules are now mirrored from docs/.oxlintrc.json, and src/ still passes.

The #6121/#6127 guard was 57 lines of hand-written AST walking with no
test. It now has one: fixtures for the three banned shapes plus an
onNumber()-wrapped control, asserting the rule fires three times and
that .oxlintrc.json still wires it to the right paths. Verified it fails
for the right reason by making walk() enumerate nothing, which is the
silent-death mode the review described — the traversal depends on
Object.keys() seeing AST children as own enumerable properties.

The fixtures deliberately violate the rule, so their oxlint config is
named guard.oxlintrc.json rather than .oxlintrc.json: oxlint discovers
nested configs by directory, which would otherwise turn the fixtures
into three lint errors. The test passes it explicitly with -c.

Also from the review:
- lint and format now cover tools/ as well as src/, so the one piece of
  hand-written lint logic in the repo is no longer the least covered
  file in it.
- lint-staged runs oxfmt before oxlint --fix. Formatting became a hard
  CI gate in this PR while the hook only ran the linter, so a commit
  could pass the hook and fail CI on formatting alone.
- .oxfmtrc.json ignores public/, so the artefacts that make gen-check
  and make msw-worker-check byte-compare stay safe even if oxfmt is
  invoked without a path argument.
- The MDX and generated-reference rationales that .prettierignore
  carried are back as comments in docs/.oxfmtrc.json — oxlint and oxfmt
  both accept JSONC, so relocating them was unnecessary.

Not applied: the review also suggested restoring ../internal/web/dist to
the ignore lists. Both tools reject `..` patterns outright ("patterns
are resolved within the config file's directory"), and being outside
frontend/ it is unreachable anyway.

frontend/src/lib/xray/inbound-link.ts

@@ -23,7 +23,8 @@ import { deriveSpiderX } from './spider-x';
 // directly.
 
 type ForceTls = 'same' | 'tls' | 'none';
-const SHARE_HOSTNAME_RE = /^[A-Za-z0-9]([A-Za-z0-9-]*[A-Za-z0-9])?(\.[A-Za-z0-9]([A-Za-z0-9-]*[A-Za-z0-9])?)*$/;
+const SHARE_HOSTNAME_RE =
+  /^[A-Za-z0-9]([A-Za-z0-9-]*[A-Za-z0-9])?(\.[A-Za-z0-9]([A-Za-z0-9-]*[A-Za-z0-9])?)*$/;
 
 // Format a host for interpolation into a URL authority. IPv6 literals are
 // wrapped in square brackets per RFC 3986; IPv4 and hostnames are left as-is.
@@ -56,7 +57,12 @@ function buildXhttpExtra(xhttp: XHttpStreamSettings | undefined): Record<string,
   }
   if (xhttp.xPaddingObfsMode === true) {
     extra.xPaddingObfsMode = true;
-    for (const k of ['xPaddingKey', 'xPaddingHeader', 'xPaddingPlacement', 'xPaddingMethod'] as const) {
+    for (const k of [
+      'xPaddingKey',
+      'xPaddingHeader',
+      'xPaddingPlacement',
+      'xPaddingMethod',
+    ] as const) {
       const v = xhttp[k];
       if (typeof v === 'string' && v.length > 0) extra[k] = v;
     }
@@ -108,7 +114,10 @@ function buildXhttpExtra(xhttp: XHttpStreamSettings | undefined): Record<string,
   return Object.keys(extra).length > 0 ? extra : null;
 }
 
-function applyXhttpExtraToObj(xhttp: XHttpStreamSettings | undefined, obj: Record<string, unknown>): void {
+function applyXhttpExtraToObj(
+  xhttp: XHttpStreamSettings | undefined,
+  obj: Record<string, unknown>,
+): void {
   if (!xhttp) return;
   if (typeof xhttp.xPaddingBytes === 'string' && xhttp.xPaddingBytes.length > 0) {
     obj.x_padding_bytes = xhttp.xPaddingBytes;
@@ -161,9 +170,11 @@ function applyExternalProxyTLSObj(
   security: string,
 ): void {
   if (!externalProxy || security !== 'tls') return;
-  const sni = externalProxy.sni && externalProxy.sni.length > 0 ? externalProxy.sni : externalProxy.dest;
+  const sni =
+    externalProxy.sni && externalProxy.sni.length > 0 ? externalProxy.sni : externalProxy.dest;
   if (sni && sni.length > 0) obj.sni = sni;
-  if (externalProxy.fingerprint && externalProxy.fingerprint.length > 0) obj.fp = externalProxy.fingerprint;
+  if (externalProxy.fingerprint && externalProxy.fingerprint.length > 0)
+    obj.fp = externalProxy.fingerprint;
   const alpn = externalProxyAlpn(externalProxy.alpn);
   if (alpn.length > 0) obj.alpn = alpn;
   const pins = externalProxyPins(externalProxy.pinnedPeerCertSha256);
@@ -171,7 +182,8 @@ function applyExternalProxyTLSObj(
   if (externalProxy.verifyPeerCertByName && externalProxy.verifyPeerCertByName.length > 0) {
     obj.vcn = externalProxy.verifyPeerCertByName;
   }
-  if (externalProxy.echConfigList && externalProxy.echConfigList.length > 0) obj.ech = externalProxy.echConfigList;
+  if (externalProxy.echConfigList && externalProxy.echConfigList.length > 0)
+    obj.ech = externalProxy.echConfigList;
 }
 
 export interface GenVmessLinkInput {
@@ -227,8 +239,8 @@ export function genVmessLink(input: GenVmessLinkInput): string {
         if (request) {
           obj.path = request.path.join(',');
           const host =
-            getHeaderValue(header.response?.headers, 'host')
-            || getHeaderValue(request.headers, 'host');
+            getHeaderValue(header.response?.headers, 'host') ||
+            getHeaderValue(request.headers, 'host');
           if (host) obj.host = host;
         }
       }
@@ -287,7 +299,10 @@ export function genVmessLink(input: GenVmessLinkInput): string {
 // directly. Number values get coerced via .toString() on set — same as
 // what URLSearchParams does internally so the resulting URL bytes match.
 
-function applyXhttpExtraToParams(xhttp: XHttpStreamSettings | undefined, params: URLSearchParams): void {
+function applyXhttpExtraToParams(
+  xhttp: XHttpStreamSettings | undefined,
+  params: URLSearchParams,
+): void {
   if (!xhttp) return;
   params.set('path', xhttp.path);
   const host = xhttp.host.length > 0 ? xhttp.host : xhttpHostFallback(xhttp);
@@ -300,7 +315,10 @@ function applyXhttpExtraToParams(xhttp: XHttpStreamSettings | undefined, params:
   if (extra) params.set('extra', JSON.stringify(extra));
 }
 
-function applyFinalMaskToParams(finalmask: FinalMaskStreamSettings | undefined, params: URLSearchParams): void {
+function applyFinalMaskToParams(
+  finalmask: FinalMaskStreamSettings | undefined,
+  params: URLSearchParams,
+): void {
   const payload = serializeFinalMask(finalmask);
   if (payload.length > 0) params.set('fm', payload);
 }
@@ -311,9 +329,11 @@ function applyExternalProxyTLSParams(
   security: string,
 ): void {
   if (!externalProxy || security !== 'tls') return;
-  const sni = externalProxy.sni && externalProxy.sni.length > 0 ? externalProxy.sni : externalProxy.dest;
+  const sni =
+    externalProxy.sni && externalProxy.sni.length > 0 ? externalProxy.sni : externalProxy.dest;
   if (sni && sni.length > 0) params.set('sni', sni);
-  if (externalProxy.fingerprint && externalProxy.fingerprint.length > 0) params.set('fp', externalProxy.fingerprint);
+  if (externalProxy.fingerprint && externalProxy.fingerprint.length > 0)
+    params.set('fp', externalProxy.fingerprint);
   const alpn = externalProxyAlpn(externalProxy.alpn);
   if (alpn.length > 0) params.set('alpn', alpn);
   const pins = externalProxyPins(externalProxy.pinnedPeerCertSha256);
@@ -321,7 +341,8 @@ function applyExternalProxyTLSParams(
   if (externalProxy.verifyPeerCertByName && externalProxy.verifyPeerCertByName.length > 0) {
     params.set('vcn', externalProxy.verifyPeerCertByName);
   }
-  if (externalProxy.echConfigList && externalProxy.echConfigList.length > 0) params.set('ech', externalProxy.echConfigList);
+  if (externalProxy.echConfigList && externalProxy.echConfigList.length > 0)
+    params.set('ech', externalProxy.echConfigList);
 }
 
 export interface GenVlessLinkInput {
@@ -344,7 +365,8 @@ export function applyVlessRoute(id: string, route: string | undefined): string {
   if (r === '' || !/^\d{1,5}$/.test(r)) return id;
   const n = Number(r);
   if (n > 65535) return id;
-  if (!/^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/.test(id)) return id;
+  if (!/^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/.test(id))
+    return id;
   return id.slice(0, 14) + n.toString(16).padStart(4, '0') + id.slice(18);
 }
 
@@ -381,8 +403,8 @@ export function genVlessLink(input: GenVlessLinkInput): string {
       if (request) {
         params.set('path', request.path.join(','));
         const host =
-          getHeaderValue(tcp.header.response?.headers, 'host')
-          || getHeaderValue(request.headers, 'host');
+          getHeaderValue(tcp.header.response?.headers, 'host') ||
+          getHeaderValue(request.headers, 'host');
         if (host) params.set('host', host);
         params.set('headerType', 'http');
       }
@@ -434,16 +456,15 @@ export function genVlessLink(input: GenVlessLinkInput): string {
       params.set('fp', reality.settings.fingerprint);
 
       const sni =
-        reality.settings.serverName ||
-        reality.serverNames?.[0] ||
-        reality.target?.split(':')[0];
+        reality.settings.serverName || reality.serverNames?.[0] || reality.target?.split(':')[0];
 
       if (sni && sni.length > 0) params.set('sni', sni);
 
       if (reality.shortIds.length > 0) params.set('sid', reality.shortIds[0]);
       const spx = deriveSpiderX(reality.settings.spiderX, clientKey);
       if (spx.length > 0) params.set('spx', spx);
-      if (reality.settings.mldsa65Verify.length > 0) params.set('pqv', reality.settings.mldsa65Verify);
+      if (reality.settings.mldsa65Verify.length > 0)
+        params.set('pqv', reality.settings.mldsa65Verify);
     }
   } else {
     params.set('security', 'none');
@@ -453,15 +474,20 @@ export function genVlessLink(input: GenVlessLinkInput): string {
   // VLESS-level encryption stands in for transport TLS). Mirrors the backend's
   // vlessFlowAllowed and the form's flow-field gating so panel link, share
   // link and subscription agree.
-  if (flow.length > 0 && canEnableTlsFlow({
-    protocol: inbound.protocol,
-    settings: inbound.settings,
-    streamSettings: stream,
-  })) {
+  if (
+    flow.length > 0 &&
+    canEnableTlsFlow({
+      protocol: inbound.protocol,
+      settings: inbound.settings,
+      streamSettings: stream,
+    })
+  ) {
     params.set('flow', flow);
   }
 
-  const url = new URL(`vless://${applyVlessRoute(clientId, externalProxy?.vlessRoute)}@${formatUrlHost(address)}:${port}`);
+  const url = new URL(
+    `vless://${applyVlessRoute(clientId, externalProxy?.vlessRoute)}@${formatUrlHost(address)}:${port}`,
+  );
   for (const [key, value] of params) url.searchParams.set(key, value);
   url.hash = encodeURIComponent(remark);
   return url.toString();
@@ -471,7 +497,10 @@ export function genVlessLink(input: GenVlessLinkInput): string {
 // VLESS and VMess don't call this because they have minor per-protocol
 // quirks inline (vmess maps `multi` differently into obj.type; vless sets
 // encryption=none up-front).
-function writeNetworkParams(stream: NonNullable<Inbound['streamSettings']>, params: URLSearchParams): void {
+function writeNetworkParams(
+  stream: NonNullable<Inbound['streamSettings']>,
+  params: URLSearchParams,
+): void {
   if (stream.network === 'tcp') {
     const tcp = stream.tcpSettings;
     if (tcp.header?.type === 'http') {
@@ -479,8 +508,8 @@ function writeNetworkParams(stream: NonNullable<Inbound['streamSettings']>, para
       if (request) {
         params.set('path', request.path.join(','));
         const host =
-          getHeaderValue(tcp.header.response?.headers, 'host')
-          || getHeaderValue(request.headers, 'host');
+          getHeaderValue(tcp.header.response?.headers, 'host') ||
+          getHeaderValue(request.headers, 'host');
         if (host) params.set('host', host);
         params.set('headerType', 'http');
       }
@@ -507,7 +536,10 @@ function writeNetworkParams(stream: NonNullable<Inbound['streamSettings']>, para
   }
 }
 
-function writeTlsParams(stream: NonNullable<Inbound['streamSettings']>, params: URLSearchParams): void {
+function writeTlsParams(
+  stream: NonNullable<Inbound['streamSettings']>,
+  params: URLSearchParams,
+): void {
   if (stream.security !== 'tls') return;
   const tls = stream.tlsSettings;
   params.set('fp', tls.settings.fingerprint);
@@ -524,16 +556,18 @@ function writeTlsParams(stream: NonNullable<Inbound['streamSettings']>, params:
 
 // Reality query-string writer shared by VLESS and Trojan. Preserves the
 // legacy SNI-omission quirk (see genVlessLink for the full story).
-function writeRealityParams(stream: NonNullable<Inbound['streamSettings']>, params: URLSearchParams, clientKey: string): void {
+function writeRealityParams(
+  stream: NonNullable<Inbound['streamSettings']>,
+  params: URLSearchParams,
+  clientKey: string,
+): void {
   if (stream.security !== 'reality') return;
   const reality = stream.realitySettings;
   params.set('pbk', reality.settings.publicKey);
   params.set('fp', reality.settings.fingerprint);
 
   const sni =
-    reality.settings.serverName ||
-    reality.serverNames?.[0] ||
-    reality.target?.split(':')[0];
+    reality.settings.serverName || reality.serverNames?.[0] || reality.target?.split(':')[0];
 
   if (sni && sni.length > 0) params.set('sni', sni);
 
@@ -591,7 +625,9 @@ export function genTrojanLink(input: GenTrojanLinkInput): string {
     params.set('security', 'none');
   }
 
-  const url = new URL(`trojan://${encodeURIComponent(clientPassword)}@${formatUrlHost(address)}:${port}`);
+  const url = new URL(
+    `trojan://${encodeURIComponent(clientPassword)}@${formatUrlHost(address)}:${port}`,
+  );
   for (const [key, value] of params) url.searchParams.set(key, value);
   url.hash = encodeURIComponent(remark);
   return url.toString();
@@ -826,9 +862,8 @@ export function genWireguardLink(input: GenWireguardLinkInput): string {
   const url = new URL(`wireguard://${formatUrlHost(address)}:${port}`);
   url.username = peer.privateKey ?? '';
 
-  const pubKey = settings.secretKey.length > 0
-    ? Wireguard.generateKeypair(settings.secretKey).publicKey
-    : '';
+  const pubKey =
+    settings.secretKey.length > 0 ? Wireguard.generateKeypair(settings.secretKey).publicKey : '';
   if (pubKey.length > 0) url.searchParams.set('publickey', pubKey);
   if (peer.allowedIPs.length > 0) {
     url.searchParams.set('address', peer.allowedIPs.join(','));
@@ -852,9 +887,8 @@ export function genWireguardConfig(input: GenWireguardLinkInput): string {
   const peer = settings.peers[peerIndex];
   if (!peer) return '';
 
-  const pubKey = settings.secretKey.length > 0
-    ? Wireguard.generateKeypair(settings.secretKey).publicKey
-    : '';
+  const pubKey =
+    settings.secretKey.length > 0 ? Wireguard.generateKeypair(settings.secretKey).publicKey : '';
 
   let txt = `[Interface]\n`;
   txt += `PrivateKey = ${peer.privateKey ?? ''}\n`;
@@ -945,12 +979,7 @@ function isUnixSocketListen(listen: string): boolean {
 
 function normalizeShareHost(host: string): string {
   const h = host.trim();
-  if (
-    h.length === 0
-    || h.includes('://')
-    || h.startsWith('//')
-    || /[/?#@]/.test(h)
-  ) {
+  if (h.length === 0 || h.includes('://') || h.startsWith('//') || /[/?#@]/.test(h)) {
     return '';
   }
   if (h.startsWith('[')) {
@@ -972,7 +1001,9 @@ function normalizeShareHost(host: string): string {
 }
 
 function isShareableHost(host: string): boolean {
-  const h = normalizeShareHost(host).replace(/^\[|\]$/g, '').toLowerCase();
+  const h = normalizeShareHost(host)
+    .replace(/^\[|\]$/g, '')
+    .toLowerCase();
   if (h.length === 0) return false;
   if (h === '0.0.0.0' || h === '::' || h === '::0') return false;
   if (h === 'localhost' || h === '::1' || h.startsWith('127.')) return false;
@@ -1031,14 +1062,21 @@ export function resolveShareHost(
 // `node` strategy keeps the previous node-address-first behavior for
 // node-managed inbounds; other strategies let a row prefer its listen address
 // or a custom endpoint.
-export function resolveAddr(inbound: Inbound, hostOverride: string, fallbackHostname: string): string {
+export function resolveAddr(
+  inbound: Inbound,
+  hostOverride: string,
+  fallbackHostname: string,
+): string {
   return resolveShareHost(inbound, hostOverride, fallbackHostname);
 }
 
 // A loopback browser host means the panel was reached through a tunnel (e.g.
 // SSH-forwarded 127.0.0.1/localhost), so it can never be a shareable link host.
 function isLoopbackHost(host: string): boolean {
-  const h = host.trim().replace(/^\[|\]$/g, '').toLowerCase();
+  const h = host
+    .trim()
+    .replace(/^\[|\]$/g, '')
+    .toLowerCase();
   return h === 'localhost' || h === '::1' || h.startsWith('127.');
 }
 
@@ -1056,7 +1094,16 @@ export function preferPublicHost(browserHost: string, publicHost: string): strin
 // `this.clients` getter, which used isSSMultiUser to gate). Returns null
 // for SS single-user, http, mixed, tunnel, wireguard, hysteria2-without-
 // clients, and any protocol without a clients array.
-type ClientShape = { id?: string; security?: VmessSecurity; flow?: VlessClient['flow']; password?: string; auth?: string; secret?: string; email?: string; subId?: string };
+type ClientShape = {
+  id?: string;
+  security?: VmessSecurity;
+  flow?: VlessClient['flow'];
+  password?: string;
+  auth?: string;
+  secret?: string;
+  email?: string;
+  subId?: string;
+};
 
 // Mirror of the Go subKey: the stable per-client identity spx derivation
 // keys on — subscription id first, unique email as the fallback.
@@ -1100,18 +1147,34 @@ export interface GenLinkInput {
 // goes through genWireguardLinks/Configs separately, http/mixed/tunnel
 // don't have share URLs).
 export function genLink(input: GenLinkInput): string {
-  const { inbound, address, port = inbound.port, forceTls = 'same', remark = '', client, externalProxy = null } = input;
+  const {
+    inbound,
+    address,
+    port = inbound.port,
+    forceTls = 'same',
+    remark = '',
+    client,
+    externalProxy = null,
+  } = input;
   switch (inbound.protocol) {
     case 'vmess':
       return genVmessLink({
-        inbound, address, port, forceTls, remark,
+        inbound,
+        address,
+        port,
+        forceTls,
+        remark,
         clientId: client.id ?? '',
         security: client.security,
         externalProxy,
       });
     case 'vless':
       return genVlessLink({
-        inbound, address, port, forceTls, remark,
+        inbound,
+        address,
+        port,
+        forceTls,
+        remark,
         clientId: client.id ?? '',
         clientKey: clientSubKey(client),
         flow: client.flow,
@@ -1120,21 +1183,32 @@ export function genLink(input: GenLinkInput): string {
     case 'shadowsocks': {
       const isMultiUser = inbound.settings.method !== '2022-blake3-chacha20-poly1305';
       return genShadowsocksLink({
-        inbound, address, port, forceTls, remark,
+        inbound,
+        address,
+        port,
+        forceTls,
+        remark,
         clientPassword: isMultiUser ? (client.password ?? '') : '',
         externalProxy,
       });
     }
     case 'trojan':
       return genTrojanLink({
-        inbound, address, port, forceTls, remark,
+        inbound,
+        address,
+        port,
+        forceTls,
+        remark,
         clientPassword: client.password ?? '',
         clientKey: clientSubKey(client),
         externalProxy,
       });
     case 'hysteria':
       return genHysteriaLink({
-        inbound, address, port, remark,
+        inbound,
+        address,
+        port,
+        remark,
         clientAuth: client.auth ?? '',
         externalProxy,
       });
@@ -1163,13 +1237,7 @@ export interface GenAllLinksInput {
 // remark plus the externalProxy remark, dash-joined (the configurable
 // subscription remark model was removed; subscription output uses the template).
 export function genAllLinks(input: GenAllLinksInput): GenAllLinksEntry[] {
-  const {
-    inbound,
-    remark = '',
-    client,
-    hostOverride = '',
-    fallbackHostname,
-  } = input;
+  const { inbound, remark = '', client, hostOverride = '', fallbackHostname } = input;
 
   const addr = resolveAddr(inbound, hostOverride, fallbackHostname);
   const port = inbound.port;
@@ -1180,7 +1248,12 @@ export function genAllLinks(input: GenAllLinksInput): GenAllLinksEntry[] {
   const externals = inbound.streamSettings?.externalProxy;
   if (!externals || externals.length === 0) {
     const r = composeRemark('');
-    return [{ remark: r, link: genLink({ inbound, address: addr, port, forceTls: 'same', remark: r, client }) }];
+    return [
+      {
+        remark: r,
+        link: genLink({ inbound, address: addr, port, forceTls: 'same', remark: r, client }),
+      },
+    ];
   }
   return externals.map((ep) => {
     const r = composeRemark(ep.remark);
@@ -1212,12 +1285,7 @@ export interface GenInboundLinksInput {
 // and emits per-peer .conf blocks for wireguard. Returns '' for the
 // other clientless protocols (http, mixed, tunnel).
 export function genInboundLinks(input: GenInboundLinksInput): string {
-  const {
-    inbound,
-    remark = '',
-    hostOverride = '',
-    fallbackHostname,
-  } = input;
+  const { inbound, remark = '', hostOverride = '', fallbackHostname } = input;
   const addr = resolveAddr(inbound, hostOverride, fallbackHostname);
   const clients = getInboundClients(inbound);
   if (clients) {
@@ -1229,7 +1297,13 @@ export function genInboundLinks(input: GenInboundLinksInput): string {
     return links.join('\r\n');
   }
   if (inbound.protocol === 'shadowsocks') {
-    return genShadowsocksLink({ inbound, address: addr, port: inbound.port, forceTls: 'same', remark });
+    return genShadowsocksLink({
+      inbound,
+      address: addr,
+      port: inbound.port,
+      forceTls: 'same',
+      remark,
+    });
   }
   if (inbound.protocol === 'wireguard') {
     return genWireguardConfigs({ inbound, remark, hostOverride, fallbackHostname });
@@ -1269,13 +1343,15 @@ export function genWireguardLinks(input: GenWireguardFanoutInput): string {
   const peers = wgRenderPeers(baseSettings);
   const settings: WireguardInboundSettings = { ...baseSettings, peers };
   return peers
-    .map((p, i) => genWireguardLink({
-      settings,
-      address: addr,
-      port: inbound.port,
-      remark: `${remark}${sep}${i + 1}${wgPeerCommentSuffix(p)}`,
-      peerIndex: i,
-    }))
+    .map((p, i) =>
+      genWireguardLink({
+        settings,
+        address: addr,
+        port: inbound.port,
+        remark: `${remark}${sep}${i + 1}${wgPeerCommentSuffix(p)}`,
+        peerIndex: i,
+      }),
+    )
     .join('\r\n');
 }
 
@@ -1288,13 +1364,15 @@ export function genWireguardConfigs(input: GenWireguardFanoutInput): string {
   const peers = wgRenderPeers(baseSettings);
   const settings: WireguardInboundSettings = { ...baseSettings, peers };
   return peers
-    .map((p, i) => genWireguardConfig({
-      settings,
-      address: addr,
-      port: inbound.port,
-      remark: `${remark}${sep}${i + 1}${wgPeerCommentSuffix(p)}`,
-      peerIndex: i,
-    }))
+    .map((p, i) =>
+      genWireguardConfig({
+        settings,
+        address: addr,
+        port: inbound.port,
+        remark: `${remark}${sep}${i + 1}${wgPeerCommentSuffix(p)}`,
+        peerIndex: i,
+      }),
+    )
     .join('\r\n');
 }