import { connect } from "cloudflare:sockets";

let serviceName = "";
let APP_DOMAIN = "";
let prxIP = "";
let cachedPrxList = [];

let memoryProxyCache = {
  data: [],
  lastUpdated: 0,
  ttl: 10 * 60 * 1000
};

const horse = "dHJvamFu";
const flash = "dm1lc3M=";
const neko = "dmxlc3M=";
const v2 = "djJyYXk=";

const PORTS = [443, 80];
const PROTOCOLS = [atob(horse), atob(flash), atob(neko), "ss"];
const SUB_PAGE_URL = "https://foolvpn.web.id/nautica";

const DEFAULT_CONFIG = {
  DNS_TYPE: "DOH",
  DOH_URL: "https://cloudflare-dns.com/dns-query",
  DNS_SERVER_ADDRESS: "1.1.1.1",
  DNS_SERVER_PORT: "53",
  UDP_MODE: "RELAY",
  UDP_RELAY_HOST: "wsudprelay.up.railway.app",
  UDP_RELAY_PORT: "443",
  KV_PRX_URL: "https://raw.githubusercontent.com/Ddfathu/nauticamod/refs/heads/main/proxy.json",
  PRX_BANK_URL: "https://raw.githubusercontent.com/Ddfathu/nauticamod/refs/heads/main/proxy.txt",
  REVERSE_PRX_TARGET: "",
  RAW_KV_JSON_DATA: "",
  RAW_KV_TXT_DATA: "",
  TCP_OPTIMIZE_MODE: "OFF",
  ZERO_COPY_MODE: "ON",
  EARLY_FLUSH_MODE: "ON",
  STREAM_BUFFER_MODE: "HIGH_THROUGHPUT",
  DNS_HISTORY: [
    { type: "DOH", label: "Cloudflare DoH", dohUrl: "https://cloudflare-dns.com/dns-query", isDefault: true },
    { type: "DOH", label: "Google DoH", dohUrl: "https://dns.google/dns-query", isDefault: true },
    { type: "DOH", label: "NextDNS DoH", dohUrl: "https://dns.nextdns.io/dns-query", isDefault: true },
    { type: "UDP", label: "Google DNS (8.8.8.8:53)", addr: "8.8.8.8", port: "53", isDefault: true },
    { type: "UDP", label: "Cloudflare DNS (1.1.1.1:53)", addr: "1.1.1.1", port: "53", isDefault: true }
  ],
  RELAY_HISTORY: [
    { label: "Railway WS Relay (wsudprelay.up.railway.app:443)", host: "wsudprelay.up.railway.app", port: "443", isDefault: true }
  ],
  PRX_BANK_HISTORY: [
    { label: "Default Proxy Bank TXT", url: "https://raw.githubusercontent.com/Ddfathu/nauticamod/refs/heads/main/proxy.txt", isDefault: true }
  ],
  KV_PRX_HISTORY: [
    { label: "Default Proxy JSON URL", url: "https://raw.githubusercontent.com/Ddfathu/nauticamod/refs/heads/main/proxy.json", isDefault: true }
  ],
  CUSTOM_PRX_LIST: []
};

const CONVERTER_URL = "https://api.foolvpn.web.id/convert";
const WS_READY_STATE_OPEN = 1;
const WS_READY_STATE_CLOSING = 2;
const CORS_HEADER_OPTIONS = {
  "Access-Control-Allow-Origin": "*",
  "Access-Control-Allow-Methods": "GET,HEAD,POST,OPTIONS",
  "Access-Control-Max-Age": "86400",
};

const SALT_A1 = atob("Vk1lc3MgSGVhZGVyIEFFQUQgS2V5X0xlbmd0aA==");
const SALT_A2 = atob("Vk1lc3MgSGVhZGVyIEFFQUQgTm9uY2VfTGVuZ3Ro");
const SALT_A3 = atob("Vk1lc3MgSGVhZGVyIEFFQUQgS2V5");
const SALT_A4 = atob("Vk1lc3MgSGVhZGVyIEFFQUQgTm9uY2U=");
const SALT_B1 = atob("QUVBRCBSZXNwIEhlYWRlciBMZW4gSVY=");
const SALT_B2 = atob("QUVBRCBSZXNwIEhlYWRlciBMZW4gSVY=");
const SALT_B3 = atob("QUVBRCBSZXNwIEhlYWRlciBLZXk=");
const SALT_B4 = atob("QUVBRCBSZXNwIEhlYWRlciBJVg==");

const RELAY_MAGIC = new TextEncoder().encode("VLRLY004");
const RELAY_MODE_PACKET_UDP = 0x03;
const ATYP_IPV4 = 0x01;
const ATYP_DOMAIN = 0x02;
const ATYP_IPV6 = 0x03;

function concatBytes(...parts) {
  let len = 0;
  for (const p of parts) if (p) len += p.byteLength;
  const out = new Uint8Array(len);
  let off = 0;
  for (const p of parts) {
    if (p && p.byteLength) {
      out.set(new Uint8Array(p), off);
      off += p.byteLength;
    }
  }
  return out;
}

function parseRelayEndpoint(bytes, offset = 0) {
  const b = new Uint8Array(bytes);
  if (b.byteLength < offset + 3) return null;
  const port = (b[offset] << 8) | b[offset + 1];
  const atyp = b[offset + 2];
  let p = offset + 3;
  if (atyp === ATYP_IPV4) {
    if (b.byteLength < p + 4) return null;
    return { address: Array.from(b.subarray(p, p + 4)).join("."), port, addressType: atyp, next: p + 4 };
  }
  if (atyp === ATYP_DOMAIN) {
    if (b.byteLength < p + 1) return null;
    const len = b[p++];
    if (b.byteLength < p + len) return null;
    return { address: new TextDecoder("utf-8").decode(b.subarray(p, p + len)), port, addressType: atyp, next: p + len };
  }
  if (atyp === ATYP_IPV6) {
    if (b.byteLength < p + 16) return null;
    const parts = [];
    for (let i = 0; i < 16; i += 2) parts.push(((b[p + i] << 8) | b[p + i + 1]).toString(16));
    return { address: parts.join(":"), port, addressType: atyp, next: p + 16 };
  }
  return null;
}

function encodeRelayEndpoint(address, port) {
  const p = Number(port);
  const head = new Uint8Array([(p >>> 8) & 0xff, p & 0xff]);
  if (/^(?:\d{1,3}\.){3}\d{1,3}$/.test(String(address))) {
    const ipBytes = new Uint8Array(String(address).split(".").map(Number));
    const out = new Uint8Array(head.length + 1 + ipBytes.length);
    out.set(head, 0);
    out[head.length] = ATYP_IPV4;
    out.set(ipBytes, head.length + 1);
    return out;
  }
  if (String(address).includes(":")) {
    const parts = String(address).split(":");
    const out = new Uint8Array(head.length + 1 + 16);
    out.set(head, 0);
    out[head.length] = ATYP_IPV6;
    for (let i = 0; i < 8; i++) {
      const val = parseInt(parts[i] || "0", 16);
      out[head.length + 1 + (i * 2)] = (val >>> 8) & 0xff;
      out[head.length + 1 + (i * 2) + 1] = val & 0xff;
    }
    return out;
  }
  const d = new TextEncoder().encode(String(address));
  const out = new Uint8Array(head.length + 2 + d.length);
  out.set(head, 0);
  out[head.length] = ATYP_DOMAIN;
  out[head.length + 1] = d.length;
  out.set(d, head.length + 2);
  return out;
}

function parseSocksAddress(bytes, cursor = 0) {
  const b = new Uint8Array(bytes);
  if (b.byteLength < cursor + 1) return null;
  const atyp = b[cursor++];
  let address = "";
  if (atyp === 0x01) {
    if (b.byteLength < cursor + 6) return null;
    address = Array.from(b.subarray(cursor, cursor + 4)).join(".");
    cursor += 4;
  } else if (atyp === 0x03) {
    if (b.byteLength < cursor + 1) return null;
    const len = b[cursor++];
    if (!len || b.byteLength < cursor + len + 2) return null;
    address = new TextDecoder("utf-8").decode(b.subarray(cursor, cursor + len));
    cursor += len;
  } else if (atyp === 0x04) {
    if (b.byteLength < cursor + 18) return null;
    const parts = [];
    for (let i = 0; i < 16; i += 2) parts.push(((b[cursor + i] << 8) | b[cursor + i + 1]).toString(16));
    address = parts.join(":");
    cursor += 16;
  } else return null;

  const port = (b[cursor] << 8) | b[cursor + 1];
  cursor += 2;
  return { address, port, addressType: atyp, next: cursor };
}

function encodeSocksAddress(endpoint) {
  const address = endpoint.address;
  const port = Number(endpoint.port);
  let addr;
  if (/^(?:\d{1,3}\.){3}\d{1,3}$/.test(String(address))) {
    addr = concatBytes(new Uint8Array([0x01]), new Uint8Array(String(address).split(".").map(Number)));
  } else if (String(address).includes(":")) {
    const parts = String(address).split(":");
    const b = new Uint8Array(16);
    for (let i = 0; i < 8; i++) {
      const val = parseInt(parts[i] || "0", 16);
      b[i * 2] = (val >>> 8) & 0xff;
      b[i * 2 + 1] = val & 0xff;
    }
    addr = concatBytes(new Uint8Array([0x04]), b);
  } else {
    const d = new TextEncoder().encode(String(address));
    addr = concatBytes(new Uint8Array([0x03, d.byteLength]), d);
  }
  return concatBytes(addr, new Uint8Array([(port >>> 8) & 0xff, port & 0xff]));
}

function encodeTrojanUdpPacket(endpoint, payload) {
  const p = new Uint8Array(payload);
  return concatBytes(
    encodeSocksAddress(endpoint),
    new Uint8Array([(p.byteLength >>> 8) & 0xff, p.byteLength & 0xff, 0x0d, 0x0a]),
    p
  );
}

function parseProxy(proxyStr) {
  if (!proxyStr) return null;
  const atSplit = proxyStr.split("@");
  const hostPort = atSplit[0];
  const auth = atSplit[1] || null;

  let [host, port] = hostPort.split(":");
  port = parseInt(port, 10) || 443;

  let user = null;
  let pass = null;
  if (auth && auth.includes(":")) {
    const authParts = auth.split(":");
    user = authParts[0];
    pass = authParts.slice(1).join(":");
  }

  return { host, port, user, pass };
}

async function getConfig(env) {
  let kvConfig = {};
  if (env && env.CONFIG_KV) {
    try {
      const stored = await env.CONFIG_KV.get("APP_CONFIG", { type: "json" });
      if (stored) kvConfig = stored;
    } catch (e) {}
  }

  return {
    DNS_TYPE: kvConfig.DNS_TYPE || (env && env.DNS_TYPE) || DEFAULT_CONFIG.DNS_TYPE,
    DOH_URL: kvConfig.DOH_URL || (env && env.DOH_URL) || DEFAULT_CONFIG.DOH_URL,
    DNS_SERVER_ADDRESS: kvConfig.DNS_SERVER_ADDRESS || (env && env.DNS_SERVER_ADDRESS) || DEFAULT_CONFIG.DNS_SERVER_ADDRESS,
    DNS_SERVER_PORT: parseInt(kvConfig.DNS_SERVER_PORT || (env && env.DNS_SERVER_PORT) || DEFAULT_CONFIG.DNS_SERVER_PORT),
    UDP_MODE: kvConfig.UDP_MODE || (env && env.UDP_MODE) || DEFAULT_CONFIG.UDP_MODE,
    UDP_RELAY_HOST: kvConfig.UDP_RELAY_HOST || (env && env.UDP_RELAY_HOST) || DEFAULT_CONFIG.UDP_RELAY_HOST,
    UDP_RELAY_PORT: parseInt(kvConfig.UDP_RELAY_PORT || (env && env.UDP_RELAY_PORT) || DEFAULT_CONFIG.UDP_RELAY_PORT),
    KV_PRX_URL: kvConfig.KV_PRX_URL || (env && env.KV_PRX_URL) || DEFAULT_CONFIG.KV_PRX_URL,
    PRX_BANK_URL: kvConfig.PRX_BANK_URL || (env && env.PRX_BANK_URL) || DEFAULT_CONFIG.PRX_BANK_URL,
    REVERSE_PRX_TARGET: kvConfig.REVERSE_PRX_TARGET || DEFAULT_CONFIG.REVERSE_PRX_TARGET,
    RAW_KV_JSON_DATA: kvConfig.RAW_KV_JSON_DATA || DEFAULT_CONFIG.RAW_KV_JSON_DATA,
    RAW_KV_TXT_DATA: kvConfig.RAW_KV_TXT_DATA || DEFAULT_CONFIG.RAW_KV_TXT_DATA,
    TCP_OPTIMIZE_MODE: kvConfig.TCP_OPTIMIZE_MODE !== undefined ? kvConfig.TCP_OPTIMIZE_MODE : DEFAULT_CONFIG.TCP_OPTIMIZE_MODE,
    ZERO_COPY_MODE: kvConfig.ZERO_COPY_MODE !== undefined ? kvConfig.ZERO_COPY_MODE : DEFAULT_CONFIG.ZERO_COPY_MODE,
    EARLY_FLUSH_MODE: kvConfig.EARLY_FLUSH_MODE !== undefined ? kvConfig.EARLY_FLUSH_MODE : DEFAULT_CONFIG.EARLY_FLUSH_MODE,
    STREAM_BUFFER_MODE: kvConfig.STREAM_BUFFER_MODE !== undefined ? kvConfig.STREAM_BUFFER_MODE : DEFAULT_CONFIG.STREAM_BUFFER_MODE,
    DNS_HISTORY: kvConfig.DNS_HISTORY || DEFAULT_CONFIG.DNS_HISTORY,
    RELAY_HISTORY: kvConfig.RELAY_HISTORY || DEFAULT_CONFIG.RELAY_HISTORY,
    PRX_BANK_HISTORY: kvConfig.PRX_BANK_HISTORY || DEFAULT_CONFIG.PRX_BANK_HISTORY,
    KV_PRX_HISTORY: kvConfig.KV_PRX_HISTORY || DEFAULT_CONFIG.KV_PRX_HISTORY,
    CUSTOM_PRX_LIST: kvConfig.CUSTOM_PRX_LIST || DEFAULT_CONFIG.CUSTOM_PRX_LIST
  };
}

async function getKVPrxList(config) {
  if (config.RAW_KV_JSON_DATA && config.RAW_KV_JSON_DATA.trim() !== "") {
    try {
      return JSON.parse(config.RAW_KV_JSON_DATA);
    } catch (e) {}
  }
  if (!config.KV_PRX_URL) throw new Error("No URL Provided!");
  const kvPrx = await fetch(config.KV_PRX_URL);
  return kvPrx.status == 200 ? await kvPrx.json() : {};
}

async function getPrxList(config) {
  let kvParsedList = [];
  let urlParsedList = [];

  if (config.RAW_KV_TXT_DATA && config.RAW_KV_TXT_DATA.trim() !== "") {
    const lines = config.RAW_KV_TXT_DATA.split("\n").filter(Boolean);
    kvParsedList = lines.map((entry) => {
      const [prxIP, prxPort, country, org] = entry.split(",");
      return {
        prxIP: prxIP ? prxIP.trim() : "Unknown",
        prxPort: prxPort ? prxPort.trim() : "Unknown",
        country: country ? country.trim().toUpperCase() : "Unknown",
        org: org ? org.trim() : "Unknown Org",
      };
    }).filter(Boolean);
  }

  if (config.PRX_BANK_URL) {
    try {
      const prxBank = await fetch(config.PRX_BANK_URL);
      if (prxBank.status == 200) {
        const text = (await prxBank.text()) || "";
        const prxString = text.split("\n").filter(Boolean);
        urlParsedList = prxString.map((entry) => {
          const [prxIP, prxPort, country, org] = entry.split(",");
          return {
            prxIP: prxIP ? prxIP.trim() : "Unknown",
            prxPort: prxPort ? prxPort.trim() : "Unknown",
            country: country ? country.trim().toUpperCase() : "Unknown",
            org: org ? org.trim() : "Unknown Org",
          };
        }).filter(Boolean);
      }
    } catch (e) {}
  }

  let customList = config.CUSTOM_PRX_LIST || [];
  const existingIdentifiers = new Set([
    ...kvParsedList.map(p => `${p.prxIP}:${p.prxPort}`),
    ...customList.map(p => `${p.prxIP}:${p.prxPort}`)
  ]);

  const filteredUrlList = urlParsedList.filter(p => !existingIdentifiers.has(`${p.prxIP}:${p.prxPort}`));
  cachedPrxList = [...customList, ...kvParsedList, ...filteredUrlList];
  return cachedPrxList;
}

async function checkProxyInternal(host, port, timeoutMs = 800) {
  const startTime = Date.now();
  try {
    const socket = connect({ hostname: host, port: parseInt(port) || 443 });
    await Promise.race([
      socket.opened,
      new Promise((_, reject) => setTimeout(() => reject(new Error("Timeout")), timeoutMs))
    ]);
    const latency = Date.now() - startTime;
    try { socket.close(); } catch (e) {}
    return { status: "active", latency };
  } catch (err) {
    return { status: "dead", latency: 99999 };
  }
}

async function getBestInMemoryProxy(config) {
  const now = Date.now();
  if (memoryProxyCache.data.length > 0 && (now - memoryProxyCache.lastUpdated < memoryProxyCache.ttl)) {
    const randomCached = memoryProxyCache.data[Math.floor(Math.random() * memoryProxyCache.data.length)];
    return `${randomCached.prxIP}:${randomCached.prxPort}`;
  }

  const list = await getPrxList(config);
  if (list.length === 0) return "172.232.249.224:2053";

  const prioritized = list.filter(p => p.country === "SG" || p.country === "ID");
  const targetPool = prioritized.length > 0 ? prioritized : list;
  const samples = targetPool.sort(() => 0.5 - Math.random()).slice(0, 6);
  const testResults = await Promise.all(
    samples.map(async (p) => {
      const res = await checkProxyInternal(p.prxIP, parseInt(p.prxPort) || 443, 600);
      return { ...p, latency: res.latency };
    })
  );

  testResults.sort((a, b) => a.latency - b.latency);
  const healthyOnly = testResults.filter(p => p.latency < 400);

  if (healthyOnly.length > 0) {
    memoryProxyCache.data = healthyOnly;
    memoryProxyCache.lastUpdated = now;
    return `${healthyOnly[0].prxIP}:${healthyOnly[0].prxPort}`;
  }

  const activeOnly = testResults.filter(p => p.latency < 99999);
  if (activeOnly.length > 0) {
    memoryProxyCache.data = activeOnly;
    memoryProxyCache.lastUpdated = now;
    return `${activeOnly[0].prxIP}:${activeOnly[0].prxPort}`;
  }

  return `${samples[0].prxIP}:${samples[0].prxPort}`;
}

async function getBestSgProxyInternal(config) {
  try {
    const kvPrx = await getKVPrxList(config);
    if (kvPrx && kvPrx["SG"] && Array.isArray(kvPrx["SG"]) && kvPrx["SG"].length > 0) {
      const sgPool = kvPrx["SG"];
      return sgPool[Math.floor(Math.random() * sgPool.length)];
    }
  } catch (e) {}

  const list = await getPrxList(config);
  const sgList = list.filter(p => p.country && p.country.toUpperCase() === "SG");
  const targetList = sgList.length > 0 ? sgList : list;

  if (targetList.length === 0) return "172.232.249.224:2053";
  return `${targetList[0].prxIP}:${targetList[0].prxPort}`;
}

async function reverseWeb(request, target, targetPath) {
  if (!target || target.trim() === "") target = "example.com";
  const targetUrl = new URL(request.url);
  const targetChunk = target.split(":");

  targetUrl.hostname = targetChunk[0];
  targetUrl.port = targetChunk[1]?.toString() || "443";
  targetUrl.pathname = targetPath || targetUrl.pathname;

  const modifiedHeaders = new Headers(request.headers);
  modifiedHeaders.set("Host", targetUrl.hostname);
  modifiedHeaders.set("X-Forwarded-Host", request.headers.get("Host"));

  const modifiedRequest = new Request(targetUrl, {
    method: request.method,
    headers: modifiedHeaders,
    body: request.body,
    redirect: "follow"
  });

  const response = await fetch(modifiedRequest);
  const newResponse = new Response(response.body, response);
  for (const [key, value] of Object.entries(CORS_HEADER_OPTIONS)) newResponse.headers.set(key, value);
  newResponse.headers.set("X-Proxied-By", "Cloudflare Worker");
  return newResponse;
}

export default {
  async fetch(request, env, ctx) {
    try {
      const url = new URL(request.url);
      APP_DOMAIN = url.hostname;
      serviceName = APP_DOMAIN.split(".")[0];

      const currentConfig = await getConfig(env);

      if (url.pathname === "/api/get-proxy-list") {
        const list = await getPrxList(currentConfig);
        return new Response(JSON.stringify(list), {
          headers: { 
            ...CORS_HEADER_OPTIONS, 
            "Content-Type": "application/json",
            "Cache-Control": "no-store, no-cache, must-revalidate"
          }
        });
      }

      if (url.pathname.startsWith("/api/check")) {
        const target = url.searchParams.get("ip");
        if (!target || !target.includes(":")) {
          return new Response(JSON.stringify({ status: "error", message: "Gunakan parameter ?ip=IP:PORT" }), {
            status: 400,
            headers: { ...CORS_HEADER_OPTIONS, "Content-Type": "application/json" }
          });
        }
        const hostPort = target.split("@")[0];
        const [ip, port] = hostPort.split(":");
        const res = await checkProxyInternal(ip, parseInt(port) || 443, 2500);
        return new Response(JSON.stringify({
          status: res.status,
          ip,
          port,
          latency: res.status === "active" ? `${res.latency}ms` : "timeout"
        }), {
          status: 200,
          headers: { 
            ...CORS_HEADER_OPTIONS, 
            "Content-Type": "application/json",
            "Cache-Control": "no-store, no-cache, must-revalidate"
          }
        });
      }

      // FULL HTML UI NAUTICA (DENGAN DYNAMIC CURRENT BROWSER URL)
      const htmlContent = `<!DOCTYPE html>
<html lang="id">
<head>
  <meta charset="UTF-8">
  <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no">
  <title>Nautica Worker Dashboard</title>
  <style>
    body { font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif; background-color: #000000; color: #00ffcc; padding: 16px; margin: 0; display: flex; justify-content: center; }
    .card { background-color: #050505; padding: 20px; border-radius: 12px; width: 100%; max-width: 500px; box-shadow: 0 0 25px rgba(0, 255, 204, 0.2); border: 1px solid #00ffcc; position: relative; }
    .header-bar { display: flex; align-items: center; justify-content: space-between; margin-bottom: 12px; }
    .menu-btn { font-size: 1.4rem; background: none; border: 1px solid #00ffcc; color: #00ffcc; border-radius: 6px; padding: 4px 10px; cursor: pointer; line-height: 1; }
    .menu-btn:hover { background: #00ffcc; color: #000000; }
    h2 { margin: 0; color: #00ffff; font-size: 1.1rem; text-align: center; text-shadow: 0 0 10px rgba(0, 255, 255, 0.8); flex-grow: 1; }
    .sidebar-overlay { position: fixed; top: 0; left: 0; width: 100vw; height: 100vh; background: rgba(0,0,0,0.75); display: none; z-index: 998; backdrop-filter: blur(2px); }
    .sidebar { position: fixed; top: 0; left: -290px; width: 270px; height: 100%; background: #050505; border-right: 1px solid #00ffcc; box-shadow: 5px 0 25px rgba(0, 255, 204, 0.3); z-index: 999; transition: left 0.3s ease; padding: 20px 14px; box-sizing: border-box; }
    .sidebar.open { left: 0; }
    .sidebar h3 { margin-top: 0; color: #00ffff; font-size: 1.05rem; border-bottom: 1px dashed #00ffcc; padding-bottom: 8px; }
    .side-item { display: block; width: 100%; text-align: left; padding: 12px; margin: 10px 0; background: #000000; border: 1px solid #00ffcc; border-radius: 6px; color: #00ffcc; font-size: 0.9rem; font-weight: 600; cursor: pointer; transition: 0.2s; }
    .side-item:hover, .side-item.active { background: #00ffcc; color: #000000; font-weight: bold; }
    .close-btn { float: right; background: none; border: none; color: #ff073a; font-size: 1.2rem; font-weight: bold; cursor: pointer; }
    h3 { color: #39ff14; font-size: 0.95rem; margin-top: 16px; margin-bottom: 6px; border-bottom: 1px dashed #39ff14; padding-bottom: 4px; text-shadow: 0 0 8px rgba(57, 255, 20, 0.6); }
    label { font-size: 0.8rem; font-weight: 600; color: #00ffcc; display: block; margin-top: 10px; margin-bottom: 4px; }
    input, select, textarea { width: 100%; padding: 10px; border-radius: 6px; border: 1px solid #00ffcc; background: #000000; color: #ffffff; box-sizing: border-box; font-size: 0.85rem; font-family: monospace; }
    textarea { min-height: 140px; resize: vertical; }
    input:focus, select:focus, textarea:focus { outline: none; border-color: #39ff14; box-shadow: 0 0 10px rgba(57, 255, 20, 0.6); }
    .btn-grid { display: grid; grid-template-columns: 1fr 1fr 1fr; gap: 6px; margin-top: 6px; }
    .btn-mode { padding: 9px 4px; border: 1px solid #00ffff; border-radius: 6px; background: #000000; color: #00ffff; font-weight: bold; cursor: pointer; font-size: 0.75rem; transition: 0.2s; text-align: center; }
    .btn-mode:hover { background: #00ffff; color: #000000; }
    .btn-mode.rev { border-color: #ff073a; color: #ff073a; }
    .btn-mode.rev:hover { background: #ff073a; color: #000000; }
    .btn-mode.cdn { border-color: #bf00ff; color: #bf00ff; }
    .btn-mode.cdn:hover { background: #bf00ff; color: #000000; }
    .btn-gen { background-color: #000000; color: #39ff14; border: 1px solid #39ff14; width: 100%; padding: 10px; border-radius: 6px; font-weight: bold; cursor: pointer; margin-top: 12px; }
    .btn-gen:hover { background-color: #39ff14; color: #000000; }
    .btn-copy { background-color: #000000; padding: 6px 12px; border: 1px solid #00ffff; border-radius: 4px; color: #00ffff; font-size: 0.75rem; cursor: pointer; float: right; font-weight: bold; }
    .btn-copy:hover { background-color: #00ffff; color: #000000; }
    .btn-del { background-color: #000000; color: #ff073a; border: 1px solid #ff073a; padding: 6px 12px; border-radius: 6px; font-size: 0.8rem; cursor: pointer; margin-top: 6px; display: inline-block; }
    .status { margin-top: 14px; font-size: 0.85rem; text-align: center; }
    .success { color: #39ff14; }
    .error { color: #ff073a; }
    .out-box { background: #000000; border: 1px solid #00ffcc; padding: 10px; border-radius: 6px; word-break: break-all; font-family: monospace; font-size: 0.78rem; margin-top: 8px; color: #39ff14; user-select: all; -webkit-user-select: all; }
    .custom-box { background: #000000; border: 1px dashed #00ffcc; padding: 10px; border-radius: 6px; margin-top: 8px; }
    .prx-item { background: #000000; border: 1px solid #00ffcc; padding: 8px 12px; border-radius: 6px; margin-top: 6px; display: flex; justify-content: space-between; align-items: center; font-size: 0.85rem; }
    .status-badge { display: flex; align-items: center; justify-content: center; gap: 8px; background-color: rgba(57, 255, 20, 0.08); border: 1px solid #39ff14; color: #39ff14; padding: 8px 12px; border-radius: 20px; font-size: 0.8rem; font-weight: 600; margin-bottom: 14px; }
    .pulse-dot { width: 8px; height: 8px; background-color: #39ff14; border-radius: 50%; box-shadow: 0 0 8px #39ff14; animation: pulse 1.6s infinite; }
    @keyframes pulse { 0% { transform: scale(0.95); } 70% { transform: scale(1); } 100% { transform: scale(0.95); } }
  </style>
</head>
<body>
  <div class="sidebar-overlay" id="overlay" onclick="closeSidebar()"></div>
  <div class="sidebar" id="sidebar">
    <button class="close-btn" onclick="closeSidebar()">✖</button>
    <h3>⚡ MENU NAVIGASI</h3>
    <button type="button" class="side-item active" onclick="switchNav('gen')">⚡ Generator VLESS</button>
    <button type="button" class="side-item" onclick="switchNav('add-prx')">➕ Add Proxy</button>
    <button type="button" class="side-item" onclick="switchNav('settings')">⚙️ Settings (Speed & KV)</button>
  </div>

  <div class="card">
    <div class="header-bar">
      <button class="menu-btn" onclick="openSidebar()">☰</button>
      <h2>⚡ DDFATHUVLES ULTRA SPEED</h2>
      <div style="width:34px;"></div>
    </div>

    <div class="status-badge"><span class="pulse-dot"></span> Smart Routing (/MULTI) & Browser-Host Sync Active</div>

    <!-- TAB 1: GENERATOR -->
    <div id="tab-gen">
      <label>UUID / PASS:</label>
      <input type="text" id="gen_uuid" value="${crypto.randomUUID()}">

      <label>BUG HOST (SNI / CDN):</label>
      <input type="text" id="gen_bug" value="onesignal.com" placeholder="contoh: onesignal.com">

      <label>PORT TARGET:</label>
      <select id="gen_port">
        <option value="443" selected>443 (TLS / HTTPS)</option>
        <option value="80">80 (NTLS / HTTP)</option>
        <option value="8080">8080 (NTLS Alternate)</option>
        <option value="8443">8443 (TLS Alternate)</option>
      </select>

      <label style="margin-top: 8px;">🔍 CARI / FILTER PROXY:</label>
      <input type="text" id="gen_search" style="text-transform: uppercase;" placeholder="Ketik ALL atau ID / SG / US..." oninput="this.value = this.value.toUpperCase(); filterProxyList()">

      <label style="margin-top: 8px;">PILIH TARGET PROXY IP / MODE:</label>
      <select id="gen_proxy_select" onchange="toggleCustomProxyInput()">
        <option value="MULTI" selected>🧠 /MULTI (Smart Auto: Non-CF Direct, CF Web via SG)</option>
        <option value="DIRECT">🚀 /DIRECT (Pure Direct Cloudflare)</option>
        <option value="CUSTOM">✏️ Custom / Manual Proxy Input</option>
      </select>

      <div id="custom_proxy_field" style="display:none;">
        <label>Custom Proxy (Bisa IP:Port atau IP:Port@User:Pass):</label>
        <input type="text" id="gen_ip_custom" value="172.232.249.224:2053">
      </div>

      <h3>▌ BUG SNI (NORMAL / STANDAR)</h3>
      <div class="btn-grid">
        <button type="button" class="btn-mode" onclick="makeSingleConfig('VLESS_STD')">VLESS STD</button>
        <button type="button" class="btn-mode" onclick="makeSingleConfig('TROJAN_STD')">TROJAN STD</button>
        <button type="button" class="btn-mode" onclick="makeSingleConfig('VMESS_STD')">VMESS STD</button>
      </div>

      <h3>▌ BUG SNI (REVERSE)</h3>
      <div class="btn-grid">
        <button type="button" class="btn-mode rev" onclick="makeSingleConfig('VLESS_REV')">VLESS REV</button>
        <button type="button" class="btn-mode rev" onclick="makeSingleConfig('TROJAN_REV')">TROJAN REV</button>
        <button type="button" class="btn-mode rev" onclick="makeSingleConfig('VMESS_REV')">VMESS REV</button>
      </div>

      <h3>▌ BUG CDN (PROXY PORT)</h3>
      <div class="btn-grid">
        <button type="button" class="btn-mode cdn" onclick="makeSingleConfig('VLESS_CDN')">VLESS CDN</button>
        <button type="button" class="btn-mode cdn" onclick="makeSingleConfig('TROJAN_CDN')">TROJAN CDN</button>
        <button type="button" class="btn-mode cdn" onclick="makeSingleConfig('VMESS_CDN')">VMESS CDN</button>
      </div>

      <div id="gen_results" style="display:none; margin-top: 16px;">
        <div style="display:flex; justify-content:space-between; align-items:center;">
          <strong id="result_title" style="font-size:0.85rem; color:#00ffff;">RESULT CONFIG:</strong>
          <button type="button" class="btn-copy" onclick="copyText('out_result')">[COPY]</button>
        </div>
        <div class="out-box" id="out_result"></div>
      </div>
    </div>

    <!-- TAB 2: ADD PROXY -->
    <div id="tab-add-prx" style="display: none;">
      <h3>➕ Daftarkan Custom Proxy Baru</h3>
      <form id="addProxyForm">
        <label>IP / Host Proxy:</label>
        <input type="text" id="new_prx_ip" placeholder="contoh: 172.232.249.224" required>

        <label>Port Proxy:</label>
        <input type="number" id="new_prx_port" placeholder="contoh: 2053" value="2053" required>

        <label>Kode Negara (CC):</label>
        <input type="text" id="new_prx_cc" style="text-transform: uppercase;" oninput="this.value = this.value.toUpperCase();" placeholder="contoh: ID / SG / US" value="ID" required>

        <label>Nama ISP / Org / Label:</label>
        <input type="text" id="new_prx_org" placeholder="contoh: Custom-VPS-Saya" value="My-Server">

        <button type="submit" class="btn-gen">💾 Simpan Proxy Baru Ke KV</button>
      </form>

      <h3 style="margin-top: 20px;">📋 Daftar Custom Proxy Tersimpan</h3>
      <div id="custom_prx_container"></div>
    </div>

    <!-- TAB 3: SETTINGS KV -->
    <div id="tab-settings" style="display: none;">
      <form id="configForm">
        <h3>🚀 Fitur Performa & Kecepatan (Speed Tuning)</h3>
        <label>1. Mode Zero-Copy & Native Pipe Stream:</label>
        <select id="ZERO_COPY_MODE">
          <option value="ON" ${currentConfig.ZERO_COPY_MODE === 'ON' ? 'selected' : ''}>🟢 ON (Aktif)</option>
          <option value="OFF" ${currentConfig.ZERO_COPY_MODE === 'OFF' ? 'selected' : ''}>🔴 OFF (Standard)</option>
        </select>

        <label style="margin-top: 8px;">2. Early-Socket Flush:</label>
        <select id="EARLY_FLUSH_MODE">
          <option value="ON" ${currentConfig.EARLY_FLUSH_MODE === 'ON' ? 'selected' : ''}>🟢 ON (Aktif)</option>
          <option value="OFF" ${currentConfig.EARLY_FLUSH_MODE === 'OFF' ? 'selected' : ''}>🔴 OFF (Normal)</option>
        </select>

        <label style="margin-top: 8px;">3. Stream Buffer Window:</label>
        <select id="STREAM_BUFFER_MODE">
          <option value="HIGH_THROUGHPUT" ${currentConfig.STREAM_BUFFER_MODE === 'HIGH_THROUGHPUT' ? 'selected' : ''}>🚀 High-Throughput Mode</option>
          <option value="LOW_LATENCY" ${currentConfig.STREAM_BUFFER_MODE === 'LOW_LATENCY' ? 'selected' : ''}>⚡ Low-Latency Mode</option>
        </select>

        <label style="margin-top: 8px;">4. Status TCP Optimization Legacy:</label>
        <select id="TCP_OPTIMIZE_MODE">
          <option value="OFF" ${currentConfig.TCP_OPTIMIZE_MODE === 'OFF' ? 'selected' : ''}>🔴 OFF (Dimatikan)</option>
          <option value="ON" ${currentConfig.TCP_OPTIMIZE_MODE === 'ON' ? 'selected' : ''}>🟢 ON (Diaktifkan)</option>
        </select>

        <h3>📦 Raw JSON Proxy (Simpan ke KV)</h3>
        <textarea id="RAW_KV_JSON_DATA">${currentConfig.RAW_KV_JSON_DATA || ''}</textarea>

        <h3>📄 Raw TXT Proxy Bank (Simpan ke KV)</h3>
        <textarea id="RAW_KV_TXT_DATA">${currentConfig.RAW_KV_TXT_DATA || ''}</textarea>

        <h3>🌐 DNS Settings</h3>
        <label>Pilih Preset / Riwayat DNS dari KV:</label>
        <select id="dns_select" onchange="handleDnsSelectChange()">
          <option value="DEFAULT_SCRIPT">⚙️ Default Script (DoH Cloudflare)</option>
        </select>
        <button type="button" id="btn_delete_dns" class="btn-del" style="display:none;" onclick="deleteSelectedDns()">🗑️ Hapus Preset DNS Ini</button>

        <div id="dns_custom_fields" class="custom-box" style="display: none;">
          <label>Protokol DNS:</label>
          <select id="DNS_TYPE" onchange="toggleDohInput()">
            <option value="DOH" selected>DNS over HTTPS (DoH)</option>
            <option value="UDP">UDP Standard</option>
          </select>

          <div id="doh_field" style="display: block;">
            <label>DoH Resolver URL Custom:</label>
            <input type="url" id="DOH_URL" value="${currentConfig.DOH_URL}">
          </div>

          <div id="udp_fields" style="display: none;">
            <label>DNS Server Address (UDP) Custom:</label>
            <input type="text" id="DNS_SERVER_ADDRESS" value="${currentConfig.DNS_SERVER_ADDRESS}">

            <label>DNS Server Port (UDP) Custom:</label>
            <input type="number" id="DNS_SERVER_PORT" value="${currentConfig.DNS_SERVER_PORT}">
          </div>
        </div>

        <h3>📡 UDP Handling & WebSocket Relay (Railway)</h3>
        <label>Mode UDP Routing:</label>
        <select id="UDP_MODE" onchange="toggleRelayDisplay()">
          <option value="RELAY" ${currentConfig.UDP_MODE === 'RELAY' ? 'selected' : ''}>UDP WebSocket Relay (Railway / VLRLY004)</option>
          <option value="NATIVE" ${currentConfig.UDP_MODE === 'NATIVE' ? 'selected' : ''}>Native Outbound Direct</option>
        </select>

        <div id="relay_wrapper">
          <label>Pilih Preset / Riwayat UDP Relay dari KV:</label>
          <select id="relay_select" onchange="handleRelaySelectChange()">
            <option value="DEFAULT_SCRIPT">⚙️ Default Script (wsudprelay.up.railway.app)</option>
          </select>
          <button type="button" id="btn_delete_relay" class="btn-del" style="display:none;" onclick="deleteSelectedRelay()">🗑️ Hapus Preset Relay Ini</button>

          <div id="relay_custom_fields" class="custom-box" style="display: none;">
            <label>UDP Relay Host (Domain Railway tanpa https://):</label>
            <input type="text" id="UDP_RELAY_HOST" value="${currentConfig.UDP_RELAY_HOST}">

            <label>UDP Relay Port (Wajib 443 untuk Railway):</label>
            <input type="number" id="UDP_RELAY_PORT" value="${currentConfig.UDP_RELAY_PORT}">
          </div>
        </div>

        <h3>🔗 General & Proxy URL Settings</h3>
        <label>Reverse Proxy Target Domain (Boleh Kosong):</label>
        <input type="text" id="REVERSE_PRX_TARGET" value="${currentConfig.REVERSE_PRX_TARGET}">

        <label>Proxy Bank TXT URL:</label>
        <select id="prx_bank_select" onchange="handlePrxBankSelectChange()">
          <option value="DEFAULT_SCRIPT">⚙️ Default Script</option>
        </select>
        <button type="button" id="btn_delete_prx_bank" class="btn-del" style="display:none;" onclick="deleteSelectedPrxBank()">🗑️ Hapus Preset URL Ini</button>
        
        <div id="prx_bank_custom_box" class="custom-box" style="display: none;">
          <label>Custom Proxy Bank TXT URL:</label>
          <input type="url" id="PRX_BANK_URL" value="${currentConfig.PRX_BANK_URL}">
        </div>

        <label style="margin-top: 10px;">KV Proxy List JSON URL:</label>
        <select id="kv_prx_select" onchange="handleKvPrxSelectChange()">
          <option value="DEFAULT_SCRIPT">⚙️ Default Script</option>
        </select>
        <button type="button" id="btn_delete_kv_prx" class="btn-del" style="display:none;" onclick="deleteSelectedKvPrx()">🗑️ Hapus Preset URL Ini</button>
        
        <div id="kv_prx_custom_box" class="custom-box" style="display: none;">
          <label>Custom KV Proxy JSON URL:</label>
          <input type="url" id="KV_PRX_URL" value="${currentConfig.KV_PRX_URL}">
        </div>

        <button type="submit" class="btn-gen">Simpan Konfigurasi Ke KV</button>
      </form>
    </div>

    <div id="status" class="status"></div>
  </div>

  <script>
    // Ambil host dinamis persis dari address bar browser saat dibuka
    const currentWorkerHost = window.location.hostname || "${APP_DOMAIN}";
    let rawProxyList = [];
    let currentConfig = ${JSON.stringify(currentConfig)};

    const DEFAULT_SCRIPT_DNS = { type: "DOH", dohUrl: "https://cloudflare-dns.com/dns-query", addr: "1.1.1.1", port: "53" };
    const DEFAULT_SCRIPT_RELAY = { host: "wsudprelay.up.railway.app", port: "443" };
    const DEFAULT_SCRIPT_PRX_BANK = "https://raw.githubusercontent.com/Ddfathu/nauticamod/refs/heads/main/proxy.txt";
    const DEFAULT_SCRIPT_KV_PRX = "https://raw.githubusercontent.com/Ddfathu/nauticamod/refs/heads/main/proxy.json";

    window.addEventListener('DOMContentLoaded', async () => {
      loadProxyList();
      renderDnsOptions();
      renderRelayOptions();
      renderPrxBankOptions();
      renderKvPrxOptions();
      renderCustomProxyList();
      toggleRelayDisplay();
    });

    function openSidebar() {
      document.getElementById('sidebar').classList.add('open');
      document.getElementById('overlay').style.display = 'block';
    }

    function closeSidebar() {
      document.getElementById('sidebar').classList.remove('open');
      document.getElementById('overlay').style.display = 'none';
    }

    function switchNav(tab) {
      document.getElementById('tab-gen').style.display = tab === 'gen' ? 'block' : 'none';
      document.getElementById('tab-add-prx').style.display = tab === 'add-prx' ? 'block' : 'none';
      document.getElementById('tab-settings').style.display = tab === 'settings' ? 'block' : 'none';
      
      const btns = document.querySelectorAll('.side-item');
      btns[0].classList.toggle('active', tab === 'gen');
      btns[1].classList.toggle('active', tab === 'add-prx');
      btns[2].classList.toggle('active', tab === 'settings');
      closeSidebar();
    }

    function renderCustomProxyList() {
      const container = document.getElementById('custom_prx_container');
      if (!container) return;
      container.innerHTML = '';

      if (!currentConfig.CUSTOM_PRX_LIST || currentConfig.CUSTOM_PRX_LIST.length === 0) {
        container.innerHTML = '<div style="font-size:0.8rem; color:#00ffcc; margin-top:8px;">Belum ada proxy kustom tersimpan.</div>';
        return;
      }

      currentConfig.CUSTOM_PRX_LIST.forEach((p, idx) => {
        const item = document.createElement('div');
        item.className = 'prx-item';
        item.innerHTML = '<div><strong style="color:#00ffff;">[' + p.country + '] ' + p.prxIP + ':' + p.prxPort + '</strong> <br><span style="font-size:0.75rem; color:#39ff14;">' + p.org + '</span></div>' +
          '<button type="button" class="btn-del" onclick="deleteCustomProxy(' + idx + ')">🗑️ Hapus</button>';
        container.appendChild(item);
      });
    }

    const addForm = document.getElementById('addProxyForm');
    if (addForm) {
      addForm.addEventListener('submit', async (e) => {
        e.preventDefault();
        let ip = document.getElementById('new_prx_ip').value.trim();
        const port = document.getElementById('new_prx_port').value.trim();
        const cc = document.getElementById('new_prx_cc').value.trim().toUpperCase();
        const org = document.getElementById('new_prx_org').value.trim() || 'Custom-Proxy';

        if (ip.includes(':')) ip = ip.split(':')[0];
        if (!ip || !port) return;

        const newEntry = { prxIP: ip, prxPort: port, country: cc, org: org };
        currentConfig.CUSTOM_PRX_LIST = (currentConfig.CUSTOM_PRX_LIST || []).filter(p => !(p.prxIP === ip && p.prxPort === port));
        currentConfig.CUSTOM_PRX_LIST.unshift(newEntry);
        await saveDirectPayloadToKV({ CUSTOM_PRX_LIST: currentConfig.CUSTOM_PRX_LIST });
      });
    }

    async function deleteCustomProxy(idx) {
      if (confirm('Hapus proxy kustom ini dari KV?')) {
        currentConfig.CUSTOM_PRX_LIST.splice(idx, 1);
        await saveDirectPayloadToKV({ CUSTOM_PRX_LIST: currentConfig.CUSTOM_PRX_LIST });
      }
    }

    function renderDnsOptions() {
      const select = document.getElementById('dns_select');
      if (!select) return;
      select.innerHTML = '<option value="DEFAULT_SCRIPT">⚙️ Default Script (DoH Cloudflare)</option>';

      (currentConfig.DNS_HISTORY || []).forEach((item, index) => {
        const opt = document.createElement('option');
        opt.value = index;
        opt.innerText = (item.type === 'DOH' ? '[DoH] ' : '[UDP] ') + item.label;

        if (item.type === currentConfig.DNS_TYPE) {
          if (item.type === 'DOH' && item.dohUrl === currentConfig.DOH_URL) opt.selected = true;
          else if (item.type === 'UDP' && item.addr === currentConfig.DNS_SERVER_ADDRESS && item.port == currentConfig.DNS_SERVER_PORT) opt.selected = true;
        }
        select.appendChild(opt);
      });

      const customOpt = document.createElement('option');
      customOpt.value = 'CUSTOM';
      customOpt.innerText = '✏️ Custom Input DNS Baru...';
      select.appendChild(customOpt);
      handleDnsSelectChange();
    }

    function handleDnsSelectChange() {
      const selectEl = document.getElementById('dns_select');
      if (!selectEl) return;
      const val = selectEl.value;
      const customBox = document.getElementById('dns_custom_fields');
      const delBtn = document.getElementById('btn_delete_dns');

      if (val === 'DEFAULT_SCRIPT') {
        if (customBox) customBox.style.display = 'none';
        if (delBtn) delBtn.style.display = 'none';
        document.getElementById('DNS_TYPE').value = DEFAULT_SCRIPT_DNS.type;
        document.getElementById('DOH_URL').value = DEFAULT_SCRIPT_DNS.dohUrl;
        document.getElementById('DNS_SERVER_ADDRESS').value = DEFAULT_SCRIPT_DNS.addr;
        document.getElementById('DNS_SERVER_PORT').value = DEFAULT_SCRIPT_DNS.port;
        toggleDohInput();
      } else if (val === 'CUSTOM') {
        if (customBox) customBox.style.display = 'block';
        if (delBtn) delBtn.style.display = 'none';
      } else {
        if (customBox) customBox.style.display = 'none';
        const idx = parseInt(val);
        const selectedItem = currentConfig.DNS_HISTORY[idx];
        document.getElementById('DNS_TYPE').value = selectedItem.type;
        if (selectedItem.type === 'DOH') document.getElementById('DOH_URL').value = selectedItem.dohUrl;
        else { document.getElementById('DNS_SERVER_ADDRESS').value = selectedItem.addr; document.getElementById('DNS_SERVER_PORT').value = selectedItem.port; }
        toggleDohInput();
        if (delBtn) delBtn.style.display = selectedItem.isDefault ? 'none' : 'inline-block';
      }
    }

    async function deleteSelectedDns() {
      const val = document.getElementById('dns_select').value;
      if (val === 'CUSTOM' || val === 'DEFAULT_SCRIPT') return;
      const idx = parseInt(val);
      if (confirm('Yakin ingin menghapus preset DNS ini dari KV?')) {
        currentConfig.DNS_HISTORY.splice(idx, 1);
        await saveDirectPayloadToKV({ DNS_HISTORY: currentConfig.DNS_HISTORY });
      }
    }

    function toggleDohInput() {
      const type = document.getElementById('DNS_TYPE')?.value;
      const doh = document.getElementById('doh_field');
      const udp = document.getElementById('udp_fields');
      if (doh) doh.style.display = type === 'DOH' ? 'block' : 'none';
      if (udp) udp.style.display = type === 'UDP' ? 'block' : 'none';
    }

    function renderRelayOptions() {
      const select = document.getElementById('relay_select');
      if (!select) return;
      select.innerHTML = '<option value="DEFAULT_SCRIPT">⚙️ Default Script (wsudprelay.up.railway.app)</option>';

      (currentConfig.RELAY_HISTORY || []).forEach((item, index) => {
        const opt = document.createElement('option');
        opt.value = index;
        opt.innerText = item.label;
        if (item.host === currentConfig.UDP_RELAY_HOST && item.port == currentConfig.UDP_RELAY_PORT) opt.selected = true;
        select.appendChild(opt);
      });

      const customOpt = document.createElement('option');
      customOpt.value = 'CUSTOM';
      customOpt.innerText = '✏️ Custom Input Relay Baru...';
      select.appendChild(customOpt);
      handleRelaySelectChange();
    }

    function handleRelaySelectChange() {
      const selectEl = document.getElementById('relay_select');
      if (!selectEl) return;
      const val = selectEl.value;
      const customBox = document.getElementById('relay_custom_fields');
      const delBtn = document.getElementById('btn_delete_relay');

      if (val === 'DEFAULT_SCRIPT') {
        if (customBox) customBox.style.display = 'none';
        if (delBtn) delBtn.style.display = 'none';
        document.getElementById('UDP_RELAY_HOST').value = DEFAULT_SCRIPT_RELAY.host;
        document.getElementById('UDP_RELAY_PORT').value = DEFAULT_SCRIPT_RELAY.port;
      } else if (val === 'CUSTOM') {
        if (customBox) customBox.style.display = 'block';
        if (delBtn) delBtn.style.display = 'none';
      } else {
        if (customBox) customBox.style.display = 'none';
        const idx = parseInt(val);
        const selectedItem = currentConfig.RELAY_HISTORY[idx];
        document.getElementById('UDP_RELAY_HOST').value = selectedItem.host;
        document.getElementById('UDP_RELAY_PORT').value = selectedItem.port;
        if (delBtn) delBtn.style.display = selectedItem.isDefault ? 'none' : 'inline-block';
      }
    }

    async function deleteSelectedRelay() {
      const val = document.getElementById('relay_select').value;
      if (val === 'CUSTOM' || val === 'DEFAULT_SCRIPT') return;
      const idx = parseInt(val);
      if (confirm('Yakin ingin menghapus server UDP Relay ini dari KV?')) {
        currentConfig.RELAY_HISTORY.splice(idx, 1);
        await saveDirectPayloadToKV({ RELAY_HISTORY: currentConfig.RELAY_HISTORY });
      }
    }

    function toggleRelayDisplay() {
      const mode = document.getElementById('UDP_MODE')?.value;
      const wrapper = document.getElementById('relay_wrapper');
      if (wrapper) wrapper.style.display = mode === 'RELAY' ? 'block' : 'none';
    }

    function renderPrxBankOptions() {
      const select = document.getElementById('prx_bank_select');
      if (!select) return;
      select.innerHTML = '<option value="DEFAULT_SCRIPT">⚙️ Default Script</option>';

      (currentConfig.PRX_BANK_HISTORY || []).forEach((item, index) => {
        const opt = document.createElement('option');
        opt.value = index;
        opt.innerText = item.label;
        if (item.url === currentConfig.PRX_BANK_URL) opt.selected = true;
        select.appendChild(opt);
      });

      const customOpt = document.createElement('option');
      customOpt.value = 'CUSTOM';
      customOpt.innerText = '✏️ Custom URL Proxy Bank Baru...';
      select.appendChild(customOpt);
      handlePrxBankSelectChange();
    }

    function handlePrxBankSelectChange() {
      const selectEl = document.getElementById('prx_bank_select');
      if (!selectEl) return;
      const val = selectEl.value;
      const customBox = document.getElementById('prx_bank_custom_box');
      const delBtn = document.getElementById('btn_delete_prx_bank');

      if (val === 'DEFAULT_SCRIPT') {
        if (customBox) customBox.style.display = 'none';
        if (delBtn) delBtn.style.display = 'none';
        document.getElementById('PRX_BANK_URL').value = DEFAULT_SCRIPT_PRX_BANK;
      } else if (val === 'CUSTOM') {
        if (customBox) customBox.style.display = 'block';
        if (delBtn) delBtn.style.display = 'none';
      } else {
        if (customBox) customBox.style.display = 'none';
        const idx = parseInt(val);
        const selectedItem = currentConfig.PRX_BANK_HISTORY[idx];
        document.getElementById('PRX_BANK_URL').value = selectedItem.url;
        if (delBtn) delBtn.style.display = selectedItem.isDefault ? 'none' : 'inline-block';
      }
    }

    async function deleteSelectedPrxBank() {
      const val = document.getElementById('prx_bank_select').value;
      if (val === 'CUSTOM' || val === 'DEFAULT_SCRIPT') return;
      const idx = parseInt(val);
      if (confirm('Yakin ingin menghapus preset Proxy Bank URL ini dari KV?')) {
        currentConfig.PRX_BANK_HISTORY.splice(idx, 1);
        await saveDirectPayloadToKV({ PRX_BANK_HISTORY: currentConfig.PRX_BANK_HISTORY });
      }
    }

    function renderKvPrxOptions() {
      const select = document.getElementById('kv_prx_select');
      if (!select) return;
      select.innerHTML = '<option value="DEFAULT_SCRIPT">⚙️ Default Script</option>';

      (currentConfig.KV_PRX_HISTORY || []).forEach((item, index) => {
        const opt = document.createElement('option');
        opt.value = index;
        opt.innerText = item.label;
        if (item.url === currentConfig.KV_PRX_URL) opt.selected = true;
        select.appendChild(opt);
      });

      const customOpt = document.createElement('option');
      customOpt.value = 'CUSTOM';
      customOpt.innerText = '✏️ Custom URL KV Proxy JSON Baru...';
      select.appendChild(customOpt);
      handleKvPrxSelectChange();
    }

    function handleKvPrxSelectChange() {
      const selectEl = document.getElementById('kv_prx_select');
      if (!selectEl) return;
      const val = selectEl.value;
      const customBox = document.getElementById('kv_prx_custom_box');
      const delBtn = document.getElementById('btn_delete_kv_prx');

      if (val === 'DEFAULT_SCRIPT') {
        if (customBox) customBox.style.display = 'none';
        if (delBtn) delBtn.style.display = 'none';
        document.getElementById('KV_PRX_URL').value = DEFAULT_SCRIPT_KV_PRX;
      } else if (val === 'CUSTOM') {
        if (customBox) customBox.style.display = 'block';
        if (delBtn) delBtn.style.display = 'none';
      } else {
        if (customBox) customBox.style.display = 'none';
        const idx = parseInt(val);
        const selectedItem = currentConfig.KV_PRX_HISTORY[idx];
        document.getElementById('KV_PRX_URL').value = selectedItem.url;
        if (delBtn) delBtn.style.display = selectedItem.isDefault ? 'none' : 'inline-block';
      }
    }

    async function deleteSelectedKvPrx() {
      const val = document.getElementById('kv_prx_select').value;
      if (val === 'CUSTOM' || val === 'DEFAULT_SCRIPT') return;
      const idx = parseInt(val);
      if (confirm('Yakin ingin menghapus preset KV Proxy JSON URL ini dari KV?')) {
        currentConfig.KV_PRX_HISTORY.splice(idx, 1);
        await saveDirectPayloadToKV({ KV_PRX_HISTORY: currentConfig.KV_PRX_HISTORY });
      }
    }

    async function loadProxyList() {
      try {
        const res = await fetch('/api/get-proxy-list');
        rawProxyList = await res.json();
        renderProxyOptions(rawProxyList);
      } catch (e) {}
    }

    function renderProxyOptions(list) {
      const select = document.getElementById('gen_proxy_select');
      if (!select) return;
      select.innerHTML = '<option value="MULTI" selected>🧠 /MULTI (Smart: Non-CF Direct, CF Web via SG)</option><option value="DIRECT">🚀 /DIRECT (Pure Direct Cloudflare)</option><option value="CUSTOM">✏️ Custom / Manual Proxy Input</option>';

      if (list && list.length > 0) {
        list.forEach(p => {
          const opt = document.createElement('option');
          opt.value = p.prxIP + ':' + p.prxPort;
          opt.innerText = '[' + p.country + '] ' + p.prxIP + ':' + p.prxPort + ' (' + p.org + ')';
          select.appendChild(opt);
        });
      }
      toggleCustomProxyInput();
    }

    function filterProxyList() {
      const query = document.getElementById('gen_search').value.trim().toUpperCase();
      if (query === '' || query === 'ALL') {
        renderProxyOptions(rawProxyList);
        return;
      }
      const filtered = rawProxyList.filter(p => (p.country || '').trim().toUpperCase() === query);
      renderProxyOptions(filtered);
    }

    function toggleCustomProxyInput() {
      const val = document.getElementById('gen_proxy_select').value;
      const customField = document.getElementById('custom_proxy_field');
      if (customField) customField.style.display = (val === 'CUSTOM') ? 'block' : 'none';
    }

    function makeSingleConfig(mode) {
      let bug = document.getElementById('gen_bug').value.trim();
      if (bug.includes(':')) bug = bug.split(':')[0];

      const selectedPort = document.getElementById('gen_port').value;
      const proxySelect = document.getElementById('gen_proxy_select').value;
      let proxy = (proxySelect === 'CUSTOM') ? document.getElementById('gen_ip_custom').value.trim() : proxySelect;

      if (!proxy) {
        alert('Silakan tentukan/pilih IP Proxy atau Mode!');
        return;
      }

      const uuid = document.getElementById('gen_uuid').value.trim();
      const pathStr = '/' + proxy;
      const isNTLS = (selectedPort === '80' || selectedPort === '8080');
      const secMode = isNTLS ? 'none' : 'tls';

      let finalLink = '';
      let titleText = '';

      switch (mode) {
        case 'VLESS_STD':
          titleText = 'DDFATHU-VLESS-SNI-WS (STD)';
          finalLink = "vless://" + uuid + "@" + bug + ":" + selectedPort + "?encryption=none&type=ws&host=" + currentWorkerHost + "&path=" + encodeURIComponent(pathStr) + "&security=" + secMode + (secMode === 'tls' ? "&sni=" + currentWorkerHost : "") + "#VLESS-" + proxy + "-" + bug;
          break;
        case 'TROJAN_STD':
          titleText = 'DDFATHU-TROJAN-SNI-WS (STD)';
          finalLink = "trojan://" + uuid + "@" + bug + ":" + selectedPort + "?type=ws&host=" + currentWorkerHost + "&path=" + encodeURIComponent(pathStr) + "&security=" + secMode + (secMode === 'tls' ? "&sni=" + currentWorkerHost : "") + "#TROJAN-" + proxy + "-" + bug;
          break;
        case 'VMESS_STD': {
          titleText = 'DDFATHU-VMESS-SNI-WS (STD)';
          const vmessJson = {
            v: "2", ps: "VMESS-" + proxy + "-" + bug, add: bug, port: selectedPort, id: uuid, aid: "0", scy: "zero", net: "ws", type: "none", host: currentWorkerHost, path: pathStr, tls: isNTLS ? "" : "tls", sni: isNTLS ? "" : currentWorkerHost, alpn: ""
          };
          finalLink = "vmess://" + btoa(unescape(encodeURIComponent(JSON.stringify(vmessJson))));
          break;
        }
        case 'VLESS_REV':
          titleText = 'DDFATHU-VLESS-SNI-WS (REV)';
          finalLink = "vless://" + uuid + "@" + currentWorkerHost + ":" + selectedPort + "?encryption=none&type=ws&host=" + bug + "&path=" + encodeURIComponent(pathStr) + "&security=" + secMode + (secMode === 'tls' ? "&sni=" + bug : "") + "#VLESS-REV-" + proxy;
          break;
        case 'TROJAN_REV':
          titleText = 'DDFATHU-TROJAN-SNI-WS (REV)';
          finalLink = "trojan://" + uuid + "@" + currentWorkerHost + ":" + selectedPort + "?type=ws&host=" + bug + "&path=" + encodeURIComponent(pathStr) + "&security=" + secMode + (secMode === 'tls' ? "&sni=" + bug : "") + "#TROJAN-REV-" + proxy;
          break;
        case 'VMESS_REV': {
          titleText = 'DDFATHU-VMESS-SNI-WS (REV)';
          const vmessJson = {
            v: "2", ps: "VMESS-REV-" + proxy, add: currentWorkerHost, port: selectedPort, id: uuid, aid: "0", scy: "zero", net: "ws", type: "none", host: bug, path: pathStr, tls: isNTLS ? "" : "tls", sni: isNTLS ? "" : bug, alpn: ""
          };
          finalLink = "vmess://" + btoa(unescape(encodeURIComponent(JSON.stringify(vmessJson))));
          break;
        }
        case 'VLESS_CDN':
          titleText = 'DDFATHU-VLESS-CDN-NTLS';
          finalLink = "vless://" + uuid + "@" + bug + ":" + selectedPort + "?encryption=none&type=ws&host=" + currentWorkerHost + "&path=" + encodeURIComponent(pathStr) + "&security=" + secMode + "#VLESS-CDN-" + proxy;
          break;
        case 'TROJAN_CDN':
          titleText = 'DDFATHU-TROJAN-CDN-NTLS';
          finalLink = "trojan://" + uuid + "@" + bug + ":" + selectedPort + "?type=ws&host=" + currentWorkerHost + "&path=" + encodeURIComponent(pathStr) + "&security=" + secMode + "#TROJAN-CDN-" + proxy;
          break;
        case 'VMESS_CDN': {
          titleText = 'DDFATHU-VMESS-CDN-NTLS';
          const vmessJson = {
            v: "2", ps: "VMESS-CDN-" + proxy, add: bug, port: selectedPort, id: uuid, aid: "0", scy: "zero", net: "ws", type: "none", host: currentWorkerHost, path: pathStr, tls: isNTLS ? "" : "tls", sni: "", alpn: ""
          };
          finalLink = "vmess://" + btoa(unescape(encodeURIComponent(JSON.stringify(vmessJson))));
          break;
        }
      }

      document.getElementById('result_title').innerText = titleText;
      document.getElementById('out_result').innerText = finalLink;
      document.getElementById('gen_results').style.display = 'block';
    }

    function copyText(id) {
      const text = document.getElementById(id).innerText.trim();
      if (!text) return;
      if (navigator.clipboard && window.isSecureContext) {
        navigator.clipboard.writeText(text).then(() => alert('✅ Config Berhasil Disalin!'));
      } else {
        prompt('Salin manual config berikut:', text);
      }
    }

    async function saveDirectPayloadToKV(partialData) {
      const statusDiv = document.getElementById('status');
      statusDiv.className = 'status';
      statusDiv.innerText = 'Menyimpan ke KV...';

      const payload = { ...currentConfig, ...partialData };
      try {
        const res = await fetch('/api/save-config', {
          method: 'POST',
          headers: { 'Content-Type': 'application/json' },
          body: JSON.stringify(payload)
        });
        const result = await res.json();
        if (res.ok && result.success) {
          statusDiv.className = 'status success';
          statusDiv.innerText = '✅ Berhasil Disimpan!';
          setTimeout(() => location.reload(), 1000);
        } else {
          throw new Error(result.message || 'Gagal menyimpan');
        }
      } catch (err) {
        statusDiv.className = 'status error';
        statusDiv.innerText = '❌ Error: ' + err.message;
      }
    }

    const confForm = document.getElementById('configForm');
    if (confForm) {
      confForm.addEventListener('submit', async (e) => {
        e.preventDefault();
        
        const dnsSelectVal = document.getElementById('dns_select').value;
        let finalDnsType = 'DOH', finalDohUrl = document.getElementById('DOH_URL').value.trim(), finalDnsAddr = document.getElementById('DNS_SERVER_ADDRESS').value.trim(), finalDnsPort = document.getElementById('DNS_SERVER_PORT').value.trim();

        if (dnsSelectVal === 'DEFAULT_SCRIPT') {
          finalDnsType = DEFAULT_SCRIPT_DNS.type; finalDohUrl = DEFAULT_SCRIPT_DNS.dohUrl; finalDnsAddr = DEFAULT_SCRIPT_DNS.addr; finalDnsPort = DEFAULT_SCRIPT_DNS.port;
        } else if (dnsSelectVal !== 'CUSTOM') {
          const item = currentConfig.DNS_HISTORY[parseInt(dnsSelectVal)];
          finalDnsType = item.type;
          if (item.type === 'DOH') finalDohUrl = item.dohUrl; else { finalDnsAddr = item.addr; finalDnsPort = item.port; }
        } else {
          finalDnsType = document.getElementById('DNS_TYPE').value;
        }

        const relaySelectVal = document.getElementById('relay_select').value;
        let finalRelayHost = document.getElementById('UDP_RELAY_HOST').value.trim(), finalRelayPort = document.getElementById('UDP_RELAY_PORT').value.trim();

        if (relaySelectVal === 'DEFAULT_SCRIPT') {
          finalRelayHost = DEFAULT_SCRIPT_RELAY.host; finalRelayPort = DEFAULT_SCRIPT_RELAY.port;
        } else if (relaySelectVal !== 'CUSTOM') {
          const item = currentConfig.RELAY_HISTORY[parseInt(relaySelectVal)];
          finalRelayHost = item.host; finalRelayPort = item.port;
        }

        await saveDirectPayloadToKV({
          ZERO_COPY_MODE: document.getElementById('ZERO_COPY_MODE')?.value || 'ON',
          EARLY_FLUSH_MODE: document.getElementById('EARLY_FLUSH_MODE')?.value || 'ON',
          STREAM_BUFFER_MODE: document.getElementById('STREAM_BUFFER_MODE')?.value || 'HIGH_THROUGHPUT',
          TCP_OPTIMIZE_MODE: document.getElementById('TCP_OPTIMIZE_MODE')?.value || 'OFF',
          RAW_KV_JSON_DATA: document.getElementById('RAW_KV_JSON_DATA')?.value?.trim() || '',
          RAW_KV_TXT_DATA: document.getElementById('RAW_KV_TXT_DATA')?.value?.trim() || '',
          DNS_TYPE: finalDnsType || 'DOH',
          DOH_URL: finalDohUrl || 'https://cloudflare-dns.com/dns-query',
          DNS_SERVER_ADDRESS: finalDnsAddr || '1.1.1.1',
          DNS_SERVER_PORT: finalDnsPort || '53',
          UDP_MODE: document.getElementById('UDP_MODE')?.value || 'RELAY',
          UDP_RELAY_HOST: finalRelayHost || 'wsudprelay.up.railway.app',
          UDP_RELAY_PORT: finalRelayPort || '443',
          REVERSE_PRX_TARGET: document.getElementById('REVERSE_PRX_TARGET')?.value?.trim() || '',
          PRX_BANK_URL: document.getElementById('PRX_BANK_URL')?.value?.trim() || DEFAULT_SCRIPT_PRX_BANK,
          KV_PRX_URL: document.getElementById('KV_PRX_URL')?.value?.trim() || DEFAULT_SCRIPT_KV_PRX
        });
      });
    }
  </script>
</body>
</html>`;

      if (url.pathname === "/ui" || url.pathname === "/ui/" || url.pathname === "/") {
        return new Response(htmlContent, {
          headers: { 
            "Content-Type": "text/html; charset=utf-8",
            "Cache-Control": "no-store, no-cache, must-revalidate",
            ...CORS_HEADER_OPTIONS
          },
        });
      }

      if (url.pathname === "/api/save-config" && request.method === "POST") {
        if (!env || !env.CONFIG_KV) {
          return new Response(
            JSON.stringify({ success: false, message: "Binding CONFIG_KV belum diset di Cloudflare Worker!" }),
            { status: 400, headers: { ...CORS_HEADER_OPTIONS, "Content-Type": "application/json" } }
          );
        }

        const body = await request.json();
        let oldConfig = {};
        try {
          const stored = await env.CONFIG_KV.get("APP_CONFIG", { type: "json" });
          if (stored) oldConfig = stored;
        } catch (e) {}

        const mergedConfig = { ...DEFAULT_CONFIG, ...oldConfig, ...body };
        await env.CONFIG_KV.put("APP_CONFIG", JSON.stringify(mergedConfig));

        return new Response(
          JSON.stringify({ success: true, message: "Pengaturan berhasil disimpan ke KV." }),
          { status: 200, headers: { ...CORS_HEADER_OPTIONS, "Content-Type": "application/json" } }
        );
      }

      const upgradeHeader = request.headers.get("Upgrade");

      if (upgradeHeader === "websocket") {
        const rawPath = decodeURIComponent(url.pathname); 
        const cleanPath = rawPath.replace(/^\//, "");

        if (cleanPath.toUpperCase() === "MULTI") return await websocketHandler(request, currentConfig, "MULTI", "");
        if (cleanPath.toUpperCase() === "DIRECT") return await websocketHandler(request, currentConfig, "DIRECT", "");
        if (cleanPath.toUpperCase() === "SEMUA") {
          const picked = await getBestInMemoryProxy(currentConfig);
          return await websocketHandler(request, currentConfig, "PROXY", picked);
        }

        const proxyAuthMatch = cleanPath.match(/^([a-zA-Z0-9.-]+:\d+(@[a-zA-Z0-9._~%!$&'()*+,;=-]+:[a-zA-Z0-9._~%!$&'()*+,;=-]+)?)$/);
        if (proxyAuthMatch) return await websocketHandler(request, currentConfig, "PROXY", proxyAuthMatch[1]);

        const prxMatch = rawPath.match(/^\/(.+[:=-]\d+(@.+:.+)?)$/);
        if (prxMatch) return await websocketHandler(request, currentConfig, "PROXY", prxMatch[1]);

        if (/[a-z]/.test(cleanPath)) {
          const picked = await getBestSgProxyInternal(currentConfig);
          return await websocketHandler(request, currentConfig, "PROXY", picked);
        }
      }

      if (url.pathname.startsWith("/sub")) return Response.redirect(SUB_PAGE_URL + `?host=${APP_DOMAIN}`, 301);

      return await reverseWeb(request, currentConfig.REVERSE_PRX_TARGET);
    } catch (err) {
      return new Response(`Error: ${err.toString()}`, { status: 500, headers: CORS_HEADER_OPTIONS });
    }
  }
};

async function websocketHandler(request, config, routingMode = "PROXY", assignedProxy = "") {
  const webSocketPair = new WebSocketPair();
  const [client, webSocket] = Object.values(webSocketPair);
  webSocket.accept();

  let addressLog = "";
  let portLog = "";
  const log = (info, event) => console.log(`[${addressLog}:${portLog}] ${info}`, event || "");
  const earlyDataHeader = request.headers.get("sec-websocket-protocol") || "";
  const readableWebSocketStream = makeReadableWebSocketStream(webSocket, earlyDataHeader, log);

  let remoteSocketWrapper = { value: null };
  let udpRelaySession = null;
  let isDNS = false;

  readableWebSocketStream.pipeTo(
    new WritableStream({
      async write(chunk, controller) {
        if (isDNS && config.DNS_TYPE === "DOH") {
          return handleDoHOutbound(config.DOH_URL, chunk, webSocket, null, log);
        }

        if (remoteSocketWrapper.value) {
          const writer = remoteSocketWrapper.value.writable.getWriter();
          await writer.write(chunk);
          writer.releaseLock();
          return;
        }

        if (udpRelaySession) {
          await udpRelaySession.write(chunk);
          return;
        }

        const protocol = await protocolSniffer(chunk);
        let protocolHeader;

        if (protocol === atob(horse)) protocolHeader = readHorseHeader(chunk);
        else if (protocol === atob(flash)) protocolHeader = await readStreamHeader(chunk);
        else if (protocol === atob(neko)) protocolHeader = readNekoHeader(chunk);
        else if (protocol === "ss") protocolHeader = readSsHeader(chunk);
        else throw new Error("Unknown Protocol!");

        addressLog = protocolHeader.addressRemote;
        portLog = `${protocolHeader.portRemote} -> ${protocolHeader.isUDP ? "UDP" : "TCP"}`;

        if (protocolHeader.hasError) throw new Error(protocolHeader.message);

        let responseHeader = protocolHeader.version;
        if (protocol === atob(flash) && protocolHeader.needsResponse) {
          responseHeader = await generateStreamResponseHeader(
            protocolHeader.responseOptions,
            protocolHeader.encKey,
            protocolHeader.encIv
          );
        }

        if (protocolHeader.isUDP) {
          if (protocolHeader.portRemote === 53 && config.DNS_TYPE === "DOH") {
            isDNS = true;
            return handleDoHOutbound(config.DOH_URL, chunk, webSocket, responseHeader, log);
          }

          udpRelaySession = new ExactPacketUdpRelay(
            config,
            protocol,
            protocolHeader.addressRemote,
            protocolHeader.portRemote,
            webSocket,
            responseHeader
          );
          await udpRelaySession.init(protocolHeader.rawClientData);
          return;
        }

        handleTCPOutBound(
          remoteSocketWrapper,
          protocolHeader.addressRemote,
          protocolHeader.portRemote,
          protocolHeader.rawClientData,
          webSocket,
          responseHeader,
          log,
          config,
          routingMode,
          assignedProxy
        );
      },
      close() { 
        if (udpRelaySession) udpRelaySession.close();
        log(`readableWebSocketStream is closed`); 
      },
      abort(reason) { 
        if (udpRelaySession) udpRelaySession.close();
        log(`readableWebSocketStream is aborted`, reason); 
      }
    })
  ).catch(err => log("Stream pipe error", err));

  return new Response(null, { status: 101, webSocket: client });
}

// 1:1 PACKET-UDP ENGINE
class ExactPacketUdpRelay {
  constructor(config, protocol, defaultAddr, defaultPort, clientWs, responseHeader) {
    this.config = config;
    this.protocol = protocol;
    this.defaultAddr = defaultAddr;
    this.defaultPort = defaultPort;
    this.clientWs = clientWs;
    this.responseHeader = responseHeader;
    this.relayWs = null;
    this.isReady = false;
    this.queue = [];
    this.closed = false;
    this.inBuffer = new Uint8Array(0);
    this.outBuffer = new Uint8Array(0);
  }

  async init(initialData) {
    try {
      const relayHost = (this.config.UDP_RELAY_HOST || "wsudprelay.up.railway.app")
        .replace(/^https?:\/\//i, "")
        .replace(/^wss?:\/\//i, "")
        .replace(/\/+$/, "");

      const wsUrl = `https://${relayHost}/`;
      const resp = await fetch(wsUrl, { headers: { Upgrade: "websocket" } });
      const rWs = resp.webSocket;
      if (!rWs) throw new Error("Failed to connect to Railway relay");
      rWs.accept();
      this.relayWs = rWs;

      rWs.send(concatBytes(RELAY_MAGIC, new Uint8Array([RELAY_MODE_PACKET_UDP])));

      let gotAck = false;

      rWs.addEventListener("message", async (event) => {
        const chunk = new Uint8Array(event.data);
        if (!gotAck) {
          if (chunk.byteLength > 0 && chunk[0] === 0) {
            gotAck = true;
            this.isReady = true;
            this.flush();
            if (chunk.byteLength > 1) {
              this.outBuffer = concatBytes(this.outBuffer, chunk.subarray(1));
            }
          } else {
            this.close();
            return;
          }
        } else {
          this.outBuffer = concatBytes(this.outBuffer, chunk);
        }

        while (this.outBuffer.byteLength > 0) {
          const ep = parseRelayEndpoint(this.outBuffer, 0);
          if (!ep || this.outBuffer.byteLength < ep.next + 2) break;

          const payloadLen = (this.outBuffer[ep.next] << 8) | this.outBuffer[ep.next + 1];
          const totalEnd = ep.next + 2 + payloadLen;
          if (this.outBuffer.byteLength < totalEnd) break;

          const payload = this.outBuffer.slice(ep.next + 2, totalEnd);
          this.outBuffer = this.outBuffer.slice(totalEnd);

          this.emitToClient(ep, payload);
        }
      });

      rWs.addEventListener("close", () => this.close());
      rWs.addEventListener("error", () => this.close());

      if (initialData && initialData.byteLength > 0) {
        await this.write(initialData);
      }
    } catch (e) {
      this.close();
    }
  }

  async write(chunk) {
    if (this.closed) return;
    this.inBuffer = concatBytes(this.inBuffer, chunk);

    while (this.inBuffer.byteLength > 0) {
      let targetAddr = this.defaultAddr;
      let targetPort = this.defaultPort;
      let payload = null;
      let consumed = 0;

      if (this.protocol === atob(horse)) {
        const ep = parseSocksAddress(this.inBuffer, 0);
        if (!ep || this.inBuffer.byteLength < ep.next + 4) break;
        const len = (this.inBuffer[ep.next] << 8) | this.inBuffer[ep.next + 1];
        const end = ep.next + 4 + len;
        if (this.inBuffer.byteLength < end) break;

        targetAddr = ep.address;
        targetPort = ep.port;
        payload = this.inBuffer.slice(ep.next + 4, end);
        consumed = end;
      } else {
        if (this.inBuffer.byteLength < 2) break;
        const len = (this.inBuffer[0] << 8) | this.inBuffer[1];
        if (this.inBuffer.byteLength < 2 + len) break;
        payload = this.inBuffer.slice(2, 2 + len);
        consumed = 2 + len;
      }

      this.inBuffer = this.inBuffer.slice(consumed);

      const epBytes = encodeRelayEndpoint(targetAddr, targetPort);
      const lenBytes = new Uint8Array([(payload.byteLength >>> 8) & 0xff, payload.byteLength & 0xff]);
      const packet = concatBytes(epBytes, lenBytes, payload);

      if (this.isReady && this.relayWs && this.relayWs.readyState === WS_READY_STATE_OPEN) {
        this.relayWs.send(packet);
      } else {
        this.queue.push(packet);
      }
    }
  }

  emitToClient(ep, payload) {
    if (this.clientWs.readyState !== WS_READY_STATE_OPEN) return;

    let packetForClient;
    if (this.protocol === atob(horse)) {
      packetForClient = encodeTrojanUdpPacket(ep, payload);
    } else {
      const lenBytes = new Uint8Array([(payload.byteLength >>> 8) & 0xff, payload.byteLength & 0xff]);
      packetForClient = concatBytes(lenBytes, payload);
    }

    if (this.responseHeader) {
      this.clientWs.send(concatBytes(this.responseHeader, packetForClient).buffer);
      this.responseHeader = null;
    } else {
      this.clientWs.send(packetForClient.buffer || packetForClient);
    }
  }

  flush() {
    while (this.queue.length > 0) {
      const p = this.queue.shift();
      if (this.relayWs && this.relayWs.readyState === WS_READY_STATE_OPEN) {
        this.relayWs.send(p);
      }
    }
  }

  close() {
    if (this.closed) return;
    this.closed = true;
    try { this.relayWs?.close(); } catch (e) {}
    try { safeCloseWebSocket(this.clientWs); } catch (e) {}
  }
}

async function handleTCPOutBound(
  remoteSocket, addressRemote, portRemote, rawClientData, webSocket, responseHeader, log, config, routingMode, assignedProxy
) {
  async function connectAndWrite(address, port, timeoutMs = 450) {
    const tcpSocket = connect({ hostname: address, port: parseInt(port, 10) });
    remoteSocket.value = tcpSocket;
    if (timeoutMs > 0) {
      await Promise.race([
        tcpSocket.opened,
        new Promise((_, reject) => setTimeout(() => reject(new Error("Timeout")), timeoutMs))
      ]);
    }
    if (rawClientData && rawClientData.byteLength > 0) {
      const writer = tcpSocket.writable.getWriter();
      await writer.write(rawClientData);
      writer.releaseLock();
    }
    return tcpSocket;
  }

  async function connectViaHttpProxy(parsedPrx, targetHost, targetPort) {
    const tcpSocket = connect({ hostname: parsedPrx.host, port: parsedPrx.port });
    remoteSocket.value = tcpSocket;
    const writer = tcpSocket.writable.getWriter();
    let connectReq = `CONNECT ${targetHost}:${targetPort} HTTP/1.1\r\nHost: ${targetHost}:${targetPort}\r\n`;
    if (parsedPrx.user && parsedPrx.pass) {
      connectReq += `Proxy-Authorization: Basic ${btoa(`${parsedPrx.user}:${parsedPrx.pass}`)}\r\n`;
    }
    connectReq += `User-Agent: Cloudflare-Worker\r\nProxy-Connection: Keep-Alive\r\n\r\n`;
    await writer.write(new TextEncoder().encode(connectReq));
    const reader = tcpSocket.readable.getReader();
    const { value: resChunk } = await reader.read();
    reader.releaseLock();
    if (!new TextDecoder().decode(resChunk || new Uint8Array(0)).includes(" 200 ")) {
      throw new Error("Proxy tunnel failed");
    }
    if (rawClientData && rawClientData.byteLength > 0) await writer.write(rawClientData);
    writer.releaseLock();
    return tcpSocket;
  }

  async function retryProxyFallback() {
    try {
      const backupPrx = assignedProxy || (await getBestSgProxyInternal(config));
      const parsed = parseProxy(backupPrx);
      if (!parsed) return safeCloseWebSocket(webSocket);
      let tcpSocket = (parsed.user && parsed.pass)
        ? await connectViaHttpProxy(parsed, addressRemote, portRemote)
        : await connectAndWrite(parsed.host, parsed.port, 0);
      tcpSocket.closed.catch(() => {}).finally(() => safeCloseWebSocket(webSocket));
      remoteSocketToWSZeroCopy(tcpSocket, webSocket, responseHeader, null, log);
    } catch (e) {
      safeCloseWebSocket(webSocket);
    }
  }

  if (routingMode === "PROXY" && assignedProxy) {
    const parsedPrx = parseProxy(assignedProxy);
    if (parsedPrx && parsedPrx.user && parsedPrx.pass) {
      try {
        const tcpSocket = await connectViaHttpProxy(parsedPrx, addressRemote, portRemote);
        remoteSocketToWSZeroCopy(tcpSocket, webSocket, responseHeader, null, log);
        return;
      } catch (e) {
        safeCloseWebSocket(webSocket);
        return;
      }
    }
  }

  try {
    const timeoutLimit = (routingMode === "MULTI") ? 450 : 0;
    const tcpSocket = await connectAndWrite(addressRemote, portRemote, timeoutLimit);
    remoteSocketToWSZeroCopy(tcpSocket, webSocket, responseHeader, (routingMode === "MULTI" || routingMode === "PROXY") ? retryProxyFallback : null, log);
  } catch (err) {
    if (routingMode === "MULTI" || routingMode === "PROXY") await retryProxyFallback();
    else safeCloseWebSocket(webSocket);
  }
}

async function remoteSocketToWSZeroCopy(remoteSocket, webSocket, responseHeader, retry, log) {
  let header = responseHeader;
  let hasIncomingData = false;

  await remoteSocket.readable.pipeTo(
    new WritableStream({
      write(chunk) {
        hasIncomingData = true;
        if (webSocket.readyState !== WS_READY_STATE_OPEN) return;
        if (header && header.byteLength > 0) {
          const combined = new Uint8Array(header.byteLength + chunk.byteLength);
          combined.set(new Uint8Array(header), 0);
          combined.set(new Uint8Array(chunk), header.byteLength);
          webSocket.send(combined.buffer);
          header = null;
        } else {
          webSocket.send(chunk);
        }
      },
      close() {},
      abort() {}
    })
  ).catch(() => safeCloseWebSocket(webSocket));

  if (!hasIncomingData && retry) retry();
}

async function handleDoHOutbound(dohUrl, dataChunk, webSocket, responseHeader, log) {
  try {
    const dohResponse = await fetch(dohUrl, {
      method: "POST",
      headers: { "Content-Type": "application/dns-message", "Accept": "application/dns-message" },
      body: dataChunk,
    });
    if (dohResponse.ok && webSocket.readyState === WS_READY_STATE_OPEN) {
      const dnsResponseBuffer = await dohResponse.arrayBuffer();
      if (responseHeader) webSocket.send(await new Blob([responseHeader, dnsResponseBuffer]).arrayBuffer());
      else webSocket.send(dnsResponseBuffer);
    }
  } catch (e) {}
}

function makeReadableWebSocketStream(webSocketServer, earlyDataHeader, log) {
  let readableStreamCancel = false;
  return new ReadableStream({
    start(controller) {
      webSocketServer.addEventListener("message", (event) => {
        if (readableStreamCancel) return;
        controller.enqueue(event.data);
      });
      webSocketServer.addEventListener("close", () => {
        safeCloseWebSocket(webSocketServer);
        if (readableStreamCancel) return;
        controller.close();
      });
      webSocketServer.addEventListener("error", (err) => controller.error(err));
      const { earlyData, error } = base64ToArrayBuffer(earlyDataHeader);
      if (error) controller.error(error);
      else if (earlyData) controller.enqueue(earlyData);
    },
    pull(controller) {},
    cancel(reason) {
      if (readableStreamCancel) return;
      readableStreamCancel = true;
      safeCloseWebSocket(webSocketServer);
    },
  });
}

function safeCloseWebSocket(socket) {
  try {
    if (socket.readyState === WS_READY_STATE_OPEN || socket.readyState === WS_READY_STATE_CLOSING) socket.close();
  } catch (error) {}
}

async function protocolSniffer(buffer) {
  if (buffer.byteLength >= 62) {
    const horseDelimiter = new Uint8Array(buffer.slice(56, 60));
    if (horseDelimiter[0] === 0x0d && horseDelimiter[1] === 0x0a) {
      if (horseDelimiter[2] === 0x01 || horseDelimiter[2] === 0x03 || horseDelimiter[2] === 0x7f) {
        if (horseDelimiter[3] === 0x01 || horseDelimiter[3] === 0x03 || horseDelimiter[3] === 0x04) return atob(horse);
      }
    }
  }
  if (buffer.byteLength >= 18) {
    const version = new Uint8Array(buffer.slice(0, 1))[0];
    if (version === 0) {
      const protocolUuid = new Uint8Array(buffer.slice(1, 17));
      if (arrayBufferToHex(protocolUuid).match(/^[0-9a-f]{8}[0-9a-f]{4}4[0-9a-f]{3}[89ab][0-9a-f]{3}[0-9a-f]{12}$/i)) return atob(neko);
    }
  }
  if (buffer.byteLength >= 42) {
    const firstByte = new Uint8Array(buffer.slice(0, 1))[0];
    if (firstByte === 0x01 || firstByte === 0x03 || firstByte === 0x04) return "ss";
    return atob(flash);
  }
  return "ss";
}

async function generateStreamResponseHeader(responseOptions, encKey, encIv) {
  try {
    const key = (await sha256(encKey)).slice(0, 16);
    const lengthKey = (await kdf(key, [SALT_B1])).slice(0, 16);
    const lengthIv = (await kdf(key, [SALT_B2])).slice(0, 12);
    const lengthData = new Uint8Array([0, 4]);
    const encryptedLength = await aesGcmEncrypt(lengthKey, lengthIv, lengthData, new Uint8Array(0));
    const headerPayload = new Uint8Array([responseOptions[0], 0x00, 0x00, 0x00]);
    const payloadKey = (await kdf(key, [SALT_B3])).slice(0, 16);
    const payloadIv = (await kdf(key, [SALT_B4])).slice(0, 12);
    const encryptedPayload = await aesGcmEncrypt(payloadKey, payloadIv, headerPayload, new Uint8Array(0));
    const response = new Uint8Array(encryptedLength.length + encryptedPayload.length);
    response.set(encryptedLength, 0);
    response.set(encryptedPayload, encryptedLength.length);
    return response;
  } catch (e) {
    return new Uint8Array(0);
  }
}

async function readStreamHeader(buffer) {
  try {
    const uuidString = "00000000-0000-0000-0000-000000000000";
    const uuidBytes = new Uint8Array(uuidString.replace(/-/g, "").match(/.{1,2}/g).map(byte => parseInt(byte, 16)));
    const authKey = await md5(uuidBytes, new TextEncoder().encode(atob("YzQ4NjE5ZmUtOGYwMi00OWUwLWI5ZTktZWRmNzYzZTE3ZTIx")));
    const authId = new Uint8Array(buffer.slice(0, 16));
    const encryptedLength = new Uint8Array(buffer.slice(16, 34));
    const nonce = new Uint8Array(buffer.slice(34, 42));
    const lengthKey = (await kdf(authKey, [SALT_A1, authId, nonce])).slice(0, 16);
    const lengthIv = (await kdf(authKey, [SALT_A2, authId, nonce])).slice(0, 12);
    const lengthBytes = await aesGcmDecrypt(lengthKey, lengthIv, encryptedLength, authId);
    const headerLength = (lengthBytes[0] << 8) | lengthBytes[1];
    const encryptedHeader = new Uint8Array(buffer.slice(42, 42 + headerLength + 16));
    const payloadKey = (await kdf(authKey, [SALT_A3, authId, nonce])).slice(0, 16);
    const payloadIv = (await kdf(authKey, [SALT_A4, authId, nonce])).slice(0, 12);
    const headerPayload = await aesGcmDecrypt(payloadKey, payloadIv, encryptedHeader, authId);
    const view = new DataView(headerPayload.buffer);
    let offset = 0;
    const version = view.getUint8(offset++);
    if (version !== 1) return { hasError: true, message: `Invalid protocol: ${version}` };
    const encIv = new Uint8Array(headerPayload.slice(offset, offset + 16)); offset += 16;
    const encKey = new Uint8Array(headerPayload.slice(offset, offset + 16)); offset += 16;
    const options = new Uint8Array(headerPayload.slice(offset, offset + 4)); offset += 4;
    const cmd = view.getUint8(offset++);
    const isUDP = cmd !== 0x01;
    const portRemote = view.getUint16(offset, false); offset += 2;
    const addressType = view.getUint8(offset++);
    let addressRemote = "";

    switch (addressType) {
      case 1:
        addressRemote = `${view.getUint8(offset)}.${view.getUint8(offset + 1)}.${view.getUint8(offset + 2)}.${view.getUint8(offset + 3)}`;
        offset += 4;
        break;
      case 2:
      case 3:
        const domainLength = view.getUint8(offset++);
        addressRemote = new TextDecoder().decode(headerPayload.slice(offset, offset + domainLength));
        offset += domainLength;
        break;
      case 4:
        const ipv6Parts = [];
        for (let i = 0; i < 8; i++) ipv6Parts.push(view.getUint16(offset + i * 2, false).toString(16));
        addressRemote = ipv6Parts.join(":");
        offset += 16;
        break;
      default:
        return { hasError: true, message: `Invalid address type: ${addressType}` };
    }

    const rawDataIndex = 42 + headerLength + 16;
    return {
      hasError: false,
      addressRemote,
      addressType,
      portRemote,
      rawDataIndex,
      rawClientData: buffer.slice(rawDataIndex),
      version: new Uint8Array([options[0], 0]),
      isUDP,
      needsResponse: true,
      responseOptions: options,
      encKey,
      encIv,
    };
  } catch (e) {
    return { hasError: true, message: "Stream failed: " + e.message };
  }
}

function readSsHeader(ssBuffer) {
  const view = new DataView(ssBuffer);
  const addressType = view.getUint8(0);
  let addressLength = 0;
  let addressValueIndex = 1;
  let addressValue = "";

  switch (addressType) {
    case 1:
      addressLength = 4;
      addressValue = new Uint8Array(ssBuffer.slice(addressValueIndex, addressValueIndex + addressLength)).join(".");
      break;
    case 3:
      addressLength = new Uint8Array(ssBuffer.slice(addressValueIndex, addressValueIndex + 1))[0];
      addressValueIndex += 1;
      addressValue = new TextDecoder().decode(ssBuffer.slice(addressValueIndex, addressValueIndex + addressLength));
      break;
    case 4:
      addressLength = 16;
      const dataView = new DataView(ssBuffer.slice(addressValueIndex, addressValueIndex + addressLength));
      const ipv6 = [];
      for (let i = 0; i < 8; i++) ipv6.push(dataView.getUint16(i * 2).toString(16));
      addressValue = ipv6.join(":");
      break;
    default:
      return { hasError: true, message: `Invalid addressType: ${addressType}` };
  }

  const portIndex = addressValueIndex + addressLength;
  const portRemote = new DataView(ssBuffer.slice(portIndex, portIndex + 2)).getUint16(0);
  return {
    hasError: false,
    addressRemote: addressValue,
    addressType,
    portRemote,
    rawDataIndex: portIndex + 2,
    rawClientData: ssBuffer.slice(portIndex + 2),
    version: null,
    isUDP: portRemote == 53,
  };
}

function readNekoHeader(buffer) {
  const version = new Uint8Array(buffer.slice(0, 1));
  let isUDP = false;
  const optLength = new Uint8Array(buffer.slice(17, 18))[0];
  const cmd = new Uint8Array(buffer.slice(18 + optLength, 18 + optLength + 1))[0];
  if (cmd === 2) isUDP = true;
  else if (cmd !== 1) return { hasError: true, message: `cmd ${cmd} unsupported` };

  const portIndex = 18 + optLength + 1;
  const portRemote = new DataView(buffer.slice(portIndex, portIndex + 2)).getUint16(0);
  let addressIndex = portIndex + 2;
  const addressType = new Uint8Array(buffer.slice(addressIndex, addressIndex + 1))[0];
  let addressLength = 0;
  let addressValueIndex = addressIndex + 1;
  let addressValue = "";

  switch (addressType) {
    case 1:
      addressLength = 4;
      addressValue = new Uint8Array(buffer.slice(addressValueIndex, addressValueIndex + addressLength)).join(".");
      break;
    case 2:
      addressLength = new Uint8Array(buffer.slice(addressValueIndex, addressValueIndex + 1))[0];
      addressValueIndex += 1;
      addressValue = new TextDecoder().decode(buffer.slice(addressValueIndex, addressValueIndex + addressLength));
      break;
    case 3:
      addressLength = 16;
      const dataView = new DataView(buffer.slice(addressValueIndex, addressValueIndex + addressLength));
      const ipv6 = [];
      for (let i = 0; i < 8; i++) ipv6.push(dataView.getUint16(i * 2).toString(16));
      addressValue = ipv6.join(":");
      break;
    default:
      return { hasError: true, message: `invalid addressType ${addressType}` };
  }

  return {
    hasError: false,
    addressRemote: addressValue,
    addressType,
    portRemote,
    rawDataIndex: addressValueIndex + addressLength,
    rawClientData: buffer.slice(addressValueIndex + addressLength),
    version: new Uint8Array([version[0], 0]),
    isUDP,
  };
}

function readHorseHeader(buffer) {
  const dataBuffer = buffer.slice(58);
  if (dataBuffer.byteLength < 6) return { hasError: true, message: "invalid data" };
  let isUDP = false;
  const view = new DataView(dataBuffer);
  const cmd = view.getUint8(0);
  if (cmd == 3) isUDP = true;
  else if (cmd != 1) throw new Error("Unsupported cmd");

  let addressType = view.getUint8(1);
  let addressLength = 0;
  let addressValueIndex = 2;
  let addressValue = "";

  switch (addressType) {
    case 1:
      addressLength = 4;
      addressValue = new Uint8Array(dataBuffer.slice(addressValueIndex, addressValueIndex + addressLength)).join(".");
      break;
    case 3:
      addressLength = new Uint8Array(dataBuffer.slice(addressValueIndex, addressValueIndex + 1))[0];
      addressValueIndex += 1;
      addressValue = new TextDecoder().decode(dataBuffer.slice(addressValueIndex, addressValueIndex + addressLength));
      break;
    case 4:
      addressLength = 16;
      const dataView = new DataView(dataBuffer.slice(addressValueIndex, addressValueIndex + addressLength));
      const ipv6 = [];
      for (let i = 0; i < 8; i++) ipv6.push(dataView.getUint16(i * 2).toString(16));
      addressValue = ipv6.join(":");
      break;
    default:
      return { hasError: true, message: `invalid addressType ${addressType}` };
  }

  const portIndex = addressValueIndex + addressLength;
  const portRemote = new DataView(dataBuffer.slice(portIndex, portIndex + 2)).getUint16(0);
  return {
    hasError: false,
    addressRemote: addressValue,
    addressType,
    portRemote,
    rawDataIndex: portIndex + 4,
    rawClientData: dataBuffer.slice(portIndex + 4),
    version: null,
    isUDP,
  };
}

function base64ToArrayBuffer(base64Str) {
  if (!base64Str) return { error: null };
  try {
    base64Str = base64Str.replace(/-/g, "+").replace(/_/g, "/");
    const decode = atob(base64Str);
    const arryBuffer = Uint8Array.from(decode, (c) => c.charCodeAt(0));
    return { earlyData: arryBuffer.buffer, error: null };
  } catch (error) {
    return { error };
  }
}

function arrayBufferToHex(buffer) {
  return [...new Uint8Array(buffer)].map((x) => x.toString(16).padStart(2, "0")).join("");
}

async function md5(...inputs) {
  const combined = new Uint8Array(inputs.reduce((acc, input) => acc + input.length, 0));
  let offset = 0;
  for (const input of inputs) {
    combined.set(new Uint8Array(input), offset);
    offset += input.length;
  }
  const hashBuffer = await crypto.subtle.digest("MD5", combined);
  return new Uint8Array(hashBuffer);
}

async function sha256(input) {
  const hashBuffer = await crypto.subtle.digest("SHA-256", input);
  return new Uint8Array(hashBuffer);
}

async function kdf(key, path) {
  async function recursiveHash(keyBytes, innerHashFn) {
    return async (data) => {
      const ipad = new Uint8Array(64);
      const opad = new Uint8Array(64);
      ipad.set(keyBytes.slice(0, Math.min(64, keyBytes.length)));
      opad.set(keyBytes.slice(0, Math.min(64, keyBytes.length)));
      for (let i = 0; i < 64; i++) {
        ipad[i] ^= 0x36;
        opad[i] ^= 0x5c;
      }
      const innerData = new Uint8Array(ipad.length + data.length);
      innerData.set(ipad);
      innerData.set(data, ipad.length);
      const innerResult = await innerHashFn(innerData);
      const outerData = new Uint8Array(opad.length + innerResult.length);
      outerData.set(opad);
      outerData.set(innerResult, opad.length);
      return await innerHashFn(outerData);
    };
  }

  const sha256Hash = async (data) => new Uint8Array(await crypto.subtle.digest("SHA-256", data));
  let currentHashFn = await recursiveHash(new TextEncoder().encode("VMess AEAD KDF"), sha256Hash);

  for (const salt of path) {
    const saltBytes = typeof salt === "string" ? new TextEncoder().encode(salt) : new Uint8Array(salt);
    currentHashFn = await recursiveHash(saltBytes, currentHashFn);
  }
  return await currentHashFn(key);
}

async function aesGcmDecrypt(key, nonce, data, aad) {
  const cryptoKey = await crypto.subtle.importKey("raw", key, { name: "AES-GCM" }, false, ["decrypt"]);
  try {
    const decrypted = await crypto.subtle.decrypt({ name: "AES-GCM", iv: nonce, additionalData: aad }, cryptoKey, data);
    return new Uint8Array(decrypted);
  } catch (e) {
    throw new Error("AEAD decrypt error: " + e.message);
  }
}

async function aesGcmEncrypt(key, nonce, data, aad) {
  const cryptoKey = await crypto.subtle.importKey("raw", key, { name: "AES-GCM" }, false, ["encrypt"]);
  const encrypted = await crypto.subtle.encrypt({ name: "AES-GCM", iv: nonce, additionalData: aad }, cryptoKey, data);
  return new Uint8Array(encrypted);
}