init: init proj

2026-08-25 11:35:05 +08:00
commit bf7f2df67e
80 changed files with 9936 additions and 0 deletions
--- a/server/src/services/generators/clash.ts
+++ b/server/src/services/generators/clash.ts
@@ -0,0 +1,192 @@
+import YAML from 'yaml';
+import { clientSupports, normalizeSsCipher, type ExcludedNode, type NodeDto } from '@proxy-station/shared';
+import type { ProfileIR, RuleIR } from '../ir.js';
+
+export function clashProxy(n: NodeDto): Record<string, unknown> {
+  const base: Record<string, unknown> = { name: n.name, server: n.server, port: n.port };
+  switch (n.protocol) {
+    case 'vmess': {
+      Object.assign(base, { type: 'vmess', uuid: n.uuid, alterId: n.alterId, cipher: n.security || 'auto' });
+      if (n.tls) {
+        base.tls = true;
+        if (n.sni) base.servername = n.sni;
+      }
+      if (n.network === 'ws') {
+        base.network = 'ws';
+        base['ws-opts'] = {
+          path: n.wsPath,
+          ...(n.wsHost ? { headers: { Host: n.wsHost } } : {}),
+        };
+      }
+      break;
+    }
+    case 'trojan': {
+      Object.assign(base, { type: 'trojan', password: n.password, sni: n.sni || n.server });
+      if (n.network === 'ws') {
+        base.network = 'ws';
+        base['ws-opts'] = {
+          path: n.wsPath,
+          ...(n.wsHost ? { headers: { Host: n.wsHost } } : {}),
+        };
+      }
+      if (n.skipCertVerify) base['skip-cert-verify'] = true;
+      break;
+    }
+    case 'shadowsocks': {
+      Object.assign(base, { type: 'ss', cipher: normalizeSsCipher(n.method || ''), password: n.password });
+      if (n.network === 'ws') {
+        // SS over WS+TLS 在 Clash 侧唯一可行方案是 v2ray-plugin
+        base.plugin = 'v2ray-plugin';
+        base['plugin-opts'] = {
+          mode: 'websocket',
+          tls: n.tls,
+          host: n.wsHost || n.sni || n.server,
+          path: n.wsPath,
+        };
+      }
+      break;
+    }
+    case 'hysteria2': {
+      Object.assign(base, { type: 'hysteria2', password: n.password });
+      if (n.sni) base.sni = n.sni;
+      if (n.obfsType === 'salamander' && n.obfsPassword) {
+        base.obfs = 'salamander';
+        base['obfs-password'] = n.obfsPassword;
+      }
+      if (n.upMbps) base.up = `${n.upMbps} Mbps`;
+      if (n.downMbps) base.down = `${n.downMbps} Mbps`;
+      if (n.skipCertVerify) base['skip-cert-verify'] = true;
+      break;
+    }
+  }
+  return base;
+}
+
+/** Surge 独有策略 → mihomo 等价策略 */
+function mapPolicy(policy: string): string {
+  if (policy === 'REJECT-NO-DROP' || policy === 'REJECT-TINYGIF') return 'REJECT';
+  return policy;
+}
+
+/** Surge 逻辑规则里的子类型 → mihomo 命名 */
+function mapLogicValue(value: string): string {
+  return value.replace(/\bPROTOCOL\b/g, 'NETWORK');
+}
+
+const CLASH_UNSUPPORTED_RULE_TYPES = new Set(['URL-REGEX', 'USER-AGENT']);
+
+export interface ClashOutput {
+  content: string;
+  excluded: ExcludedNode[];
+  skippedRules: string[];
+}
+
+export function generateClash(ir: ProfileIR, opts: { convertBaseUrl: string }): ClashOutput {
+  const excluded: ExcludedNode[] = [];
+  const usable = ir.nodes.filter((n) => {
+    const verdict = clientSupports('clash', n);
+    if (!verdict.ok) excluded.push({ name: n.name, reason: verdict.reason! });
+    return verdict.ok;
+  });
+  const usableNames = new Set(usable.map((n) => n.name));
+
+  const proxies = usable.map(clashProxy);
+
+  const proxyGroups = ir.groups.map((g) => {
+    const group: Record<string, unknown> = { name: g.name, type: g.type };
+    const members = g.members
+      .filter((m) => m.kind !== 'node' || usableNames.has(m.name))
+      .map((m) => m.name);
+    if (g.filterRegex) {
+      group['include-all-proxies'] = true;
+      group.filter = g.filterRegex;
+    } else if (g.includeAllNodes) {
+      group['include-all-proxies'] = true;
+      const extra = members.filter((m) => !usableNames.has(m));
+      if (extra.length) group.proxies = extra;
+    } else {
+      group.proxies = members.length ? members : ['DIRECT'];
+    }
+    if (g.type !== 'select') {
+      group.url = g.testUrl || 'http://cp.cloudflare.com/generate_204';
+      group.interval = g.interval ?? 300;
+      if (g.tolerance) group.tolerance = g.tolerance;
+    }
+    return group;
+  });
+
+  // rule-providers：从启用规则引用的规则集生成，名称唯一化
+  const providerNameByRulesetId = new Map<string, string>();
+  const providers: Record<string, unknown> = {};
+  const takenNames = new Set<string>();
+  const usedRulesets = ir.rules.flatMap((r) => (r.ruleset ? [r.ruleset] : []));
+  for (const rs of usedRulesets) {
+    if (providerNameByRulesetId.has(rs.id)) continue;
+    let name = rs.name;
+    for (let i = 2; takenNames.has(name); i++) name = `${rs.name}-${i}`;
+    takenNames.add(name);
+    providerNameByRulesetId.set(rs.id, name);
+    const url = rs.needsConvert || !rs.clashUrl ? `${opts.convertBaseUrl}/ruleset/${rs.id}.yaml` : rs.clashUrl;
+    providers[name] = {
+      type: 'http',
+      url,
+      behavior: rs.clashBehavior,
+      format: rs.needsConvert || !rs.clashUrl ? 'yaml' : rs.clashFormat === 'yaml' ? 'yaml' : 'text',
+      interval: 86400,
+    };
+  }
+
+  const skippedRules: string[] = [];
+  const ruleLines: string[] = [];
+  for (const r of ir.rules) {
+    if (r.type === 'FINAL') {
+      ruleLines.push(`MATCH,${mapPolicy(r.policy)}`);
+      continue;
+    }
+    if (CLASH_UNSUPPORTED_RULE_TYPES.has(r.type)) {
+      skippedRules.push(`${r.type},${r.value},${r.policy}`);
+      continue;
+    }
+    const policy = mapPolicy(r.policy);
+    if (r.ruleset) {
+      ruleLines.push(`RULE-SET,${providerNameByRulesetId.get(r.ruleset.id)},${policy}`);
+      continue;
+    }
+    // Surge 内置规则集（非 URL）：LAN → 私网 GEOIP；SYSTEM 无对应物，跳过
+    if (r.type === 'RULE-SET' || r.type === 'DOMAIN-SET') {
+      if (r.value === 'LAN') {
+        ruleLines.push(`GEOIP,private,${policy},no-resolve`);
+      } else {
+        skippedRules.push(`${r.type},${r.value},${r.policy}`);
+      }
+      continue;
+    }
+    if (r.type === 'AND' || r.type === 'OR' || r.type === 'NOT') {
+      ruleLines.push(`${r.type},${mapLogicValue(r.value || '')},${policy}`);
+      continue;
+    }
+    const params = r.params.filter((p) => p === 'no-resolve');
+    ruleLines.push([r.type, r.value, policy, ...params].join(','));
+  }
+
+  const doc = {
+    'mixed-port': 7890,
+    'allow-lan': false,
+    mode: 'rule',
+    'log-level': 'info',
+    'unified-delay': true,
+    ipv6: false,
+    dns: {
+      enable: true,
+      listen: '0.0.0.0:1053',
+      'enhanced-mode': 'fake-ip',
+      nameserver: ['https://doh.pub/dns-query', 'https://dns.alidns.com/dns-query'],
+    },
+    proxies,
+    'proxy-groups': proxyGroups,
+    'rule-providers': providers,
+    rules: ruleLines,
+  };
+
+  return { content: YAML.stringify(doc, { lineWidth: 0 }), excluded, skippedRules };
+}
--- a/server/src/services/generators/shadowrocket-conf.ts
+++ b/server/src/services/generators/shadowrocket-conf.ts
@@ -0,0 +1,110 @@
+import type { ProfileIR } from '../ir.js';
+
+/** 成员名含空格/逗号时加引号 */
+function quoteName(name: string): string {
+  return /[\s,]/.test(name) ? `"${name}"` : name;
+}
+
+/**
+ * ShadowRocket 的 [General] 只保留它认识的通用键——模板里的 Surge 专有键
+ * （all-hybrid / udp-priority / http-api / compatibility-mode 等）会被过滤掉。
+ */
+const SR_GENERAL_KEYS = new Set([
+  'bypass-system',
+  'skip-proxy',
+  'bypass-tun',
+  'dns-server',
+  'fallback-dns-server',
+  'ipv6',
+  'prefer-ipv6',
+  'dns-direct-system',
+  'icmp-auto-reply',
+  'always-real-ip',
+  'hijack-dns',
+  'udp-policy-not-supported-behaviour',
+  'interface-mode',
+]);
+
+function shadowrocketGeneral(surgeGeneral: string): string {
+  const lines: string[] = [];
+  for (const raw of surgeGeneral.split(/\r?\n/)) {
+    const line = raw.trim();
+    if (!line || line.startsWith('#') || line.startsWith('//')) continue;
+    const key = line.split('=')[0].trim();
+    if (SR_GENERAL_KEYS.has(key)) lines.push(line);
+  }
+  // ShadowRocket 的常用默认值，模板里没有就补上
+  if (!lines.some((l) => l.startsWith('bypass-system'))) lines.push('bypass-system = true');
+  if (!lines.some((l) => l.startsWith('ipv6'))) lines.push('ipv6 = false');
+  if (!lines.some((l) => l.startsWith('dns-server'))) lines.push('dns-server = 223.5.5.5, 119.29.29.29');
+  return lines.join('\n');
+}
+
+/** ShadowRocket 不认识的规则类型 */
+const SR_UNSUPPORTED_RULE_TYPES = new Set(['DOMAIN-SET', 'AND', 'OR', 'NOT', 'URL-REGEX']);
+
+export interface ShadowrocketConfOutput {
+  content: string;
+  skippedRules: string[];
+}
+
+/**
+ * 生成 ShadowRocket 配置文件：策略组 + 规则，不含节点。
+ * 节点由「节点订阅」单独导入，策略组通过 `use=true` 引用该订阅的名称，
+ * 因此用户在 App 里给订阅起的名字必须与 subscriptionName 一致。
+ */
+export function generateShadowrocketConf(
+  ir: ProfileIR,
+  opts: { subscriptionName: string }
+): ShadowrocketConfOutput {
+  const sub = quoteName(opts.subscriptionName);
+  const lines: string[] = [];
+
+  lines.push('# 由 Proxy Station 生成的 ShadowRocket 配置（策略组 + 规则）');
+  lines.push(`# 节点请另行导入「节点订阅」，并在 App 中将其命名为：${opts.subscriptionName}`);
+  lines.push('');
+  lines.push('[General]');
+  lines.push(shadowrocketGeneral(ir.sections['General'] ?? ''));
+
+  lines.push('', '[Proxy Group]');
+  for (const g of ir.groups) {
+    const parts: string[] = [g.type];
+    if (g.filterRegex) {
+      // 地区组：引用订阅 + 正则筛选（ShadowRocket 原生支持 policy-regex-filter）
+      parts.push(sub, 'use=true', `policy-regex-filter=${g.filterRegex}`);
+    } else if (g.includeAllNodes) {
+      // 收纳全部节点：引用订阅
+      parts.push(sub, 'use=true');
+    } else {
+      const members = g.members.map((m) => quoteName(m.name));
+      parts.push(...(members.length ? members : ['DIRECT']));
+    }
+    if (g.type !== 'select') {
+      parts.push(`url=${g.testUrl || 'http://cp.cloudflare.com/generate_204'}`);
+      if (g.interval) parts.push(`interval=${g.interval}`);
+      if (g.tolerance) parts.push(`tolerance=${g.tolerance}`);
+    }
+    lines.push(`${g.name} = ${parts.join(', ')}`);
+  }
+
+  const skippedRules: string[] = [];
+  lines.push('', '[Rule]');
+  for (const r of ir.rules) {
+    if (r.type === 'FINAL') {
+      lines.push(['FINAL', quoteName(r.policy)].join(','));
+      continue;
+    }
+    if (SR_UNSUPPORTED_RULE_TYPES.has(r.type)) {
+      skippedRules.push(`${r.type},${r.ruleset ? r.ruleset.name : r.value},${r.policy}`);
+      continue;
+    }
+    const value = r.ruleset ? r.ruleset.surgeUrl : r.value;
+    lines.push([r.type, value, quoteName(r.policy), ...r.params].join(','));
+  }
+
+  for (const section of ['Host', 'URL Rewrite', 'MITM']) {
+    if (ir.sections[section]) lines.push('', `[${section}]`, ir.sections[section]);
+  }
+
+  return { content: lines.join('\n') + '\n', skippedRules };
+}
--- a/server/src/services/generators/shadowrocket.ts
+++ b/server/src/services/generators/shadowrocket.ts
@@ -0,0 +1,27 @@
+import { clientSupports, type ExcludedNode } from '@proxy-station/shared';
+import type { ProfileIR } from '../ir.js';
+import { encodeShareLink } from '../sharelink/parse.js';
+
+export interface ShadowrocketOutput {
+  content: string; // base64 后的 URI 列表（ShadowRocket 原生订阅格式）
+  excluded: ExcludedNode[];
+  uris: string[];
+}
+
+export function generateShadowrocket(ir: ProfileIR): ShadowrocketOutput {
+  const excluded: ExcludedNode[] = [];
+  const uris: string[] = [];
+  for (const n of ir.nodes) {
+    const verdict = clientSupports('shadowrocket', n);
+    if (!verdict.ok) {
+      excluded.push({ name: n.name, reason: verdict.reason! });
+      continue;
+    }
+    uris.push(encodeShareLink({ ...n, obfsType: n.obfsType as 'salamander' | null }));
+  }
+  return {
+    content: Buffer.from(uris.join('\n'), 'utf8').toString('base64'),
+    excluded,
+    uris,
+  };
+}
--- a/server/src/services/generators/surge.ts
+++ b/server/src/services/generators/surge.ts
@@ -0,0 +1,124 @@
+import { clientSupports, normalizeSsCipher, type ExcludedNode, type NodeDto } from '@proxy-station/shared';
+import type { ProfileIR } from '../ir.js';
+
+/** 成员名含空格/逗号时按 Surge 习惯加引号 */
+function quoteName(name: string): string {
+  return /[\s,]/.test(name) ? `"${name}"` : name;
+}
+
+export function surgeNodeLine(n: NodeDto): string {
+  const parts: string[] = [];
+  switch (n.protocol) {
+    case 'vmess': {
+      parts.push('vmess', n.server, String(n.port), `username=${n.uuid}`);
+      if (n.network === 'ws') {
+        parts.push('ws=true', `ws-path=${n.wsPath}`);
+        if (n.wsHost) parts.push(`ws-headers=Host:"${n.wsHost}"`);
+      }
+      if (n.tls) {
+        parts.push('tls=true');
+        if (n.sni) parts.push(`sni=${n.sni}`);
+      }
+      // alterId=0 的 AEAD 头必须显式打开，否则 Surge 连不上且症状隐晦
+      parts.push('vmess-aead=true');
+      break;
+    }
+    case 'trojan': {
+      parts.push('trojan', n.server, String(n.port), `password=${n.password}`);
+      if (n.network === 'ws') {
+        parts.push('ws=true', `ws-path=${n.wsPath}`);
+        if (n.wsHost) parts.push(`ws-headers=Host:"${n.wsHost}"`);
+      }
+      if (n.sni) parts.push(`sni=${n.sni}`);
+      if (n.skipCertVerify) parts.push('skip-cert-verify=true');
+      break;
+    }
+    case 'shadowsocks': {
+      parts.push('ss', n.server, String(n.port), `encrypt-method=${normalizeSsCipher(n.method || '')}`, `password=${n.password}`);
+      break;
+    }
+    case 'hysteria2': {
+      parts.push('hysteria2', n.server, String(n.port), `password=${n.password}`);
+      if (n.sni) parts.push(`sni=${n.sni}`);
+      // Surge 的 salamander 混淆参数名（sub-router 生产验证过）
+      if (n.obfsType === 'salamander' && n.obfsPassword) parts.push(`salamander-password=${n.obfsPassword}`);
+      if (n.downMbps) parts.push(`download-bandwidth=${n.downMbps}`);
+      if (n.skipCertVerify) parts.push('skip-cert-verify=true');
+      break;
+    }
+  }
+  return `${n.name} = ${parts.join(', ')}`;
+}
+
+export interface SurgeOutput {
+  content: string;
+  excluded: ExcludedNode[];
+}
+
+export function generateSurge(ir: ProfileIR, opts: { selfUrl: string }): SurgeOutput {
+  const excluded: ExcludedNode[] = [];
+  const usable = ir.nodes.filter((n) => {
+    const verdict = clientSupports('surge', n);
+    if (!verdict.ok) excluded.push({ name: n.name, reason: verdict.reason! });
+    return verdict.ok;
+  });
+  const usableNames = new Set(usable.map((n) => n.name));
+
+  const lines: string[] = [];
+  lines.push(`#!MANAGED-CONFIG ${opts.selfUrl} interval=86400 strict=true`);
+  lines.push('# 由 Proxy Station 生成，请勿手动编辑（改动会在下次更新时被覆盖）');
+  lines.push('');
+  lines.push('[General]');
+  lines.push(ir.sections['General'] ?? '');
+
+  lines.push('', '[Proxy]');
+  for (const n of usable) lines.push(surgeNodeLine(n));
+
+  lines.push('', '[Proxy Group]');
+  for (const g of ir.groups) {
+    const parts: string[] = [g.type];
+    const memberNames = g.members
+      .filter((m) => m.kind !== 'node' || usableNames.has(m.name))
+      .map((m) => quoteName(m.name));
+    if (g.filterRegex) {
+      // 按名称正则动态筛选：节点来源可以是全部节点，也可以是另一个组
+      if (g.includeAllNodes) {
+        parts.push('include-all-proxies=true');
+      } else {
+        const source = g.members.find((m) => m.kind === 'group');
+        if (source) parts.push(`include-other-group=${quoteName(source.name)}`);
+      }
+      parts.push(`policy-regex-filter=${g.filterRegex}`);
+    } else if (g.includeAllNodes) {
+      // 「全部节点」组：显式展开当前启用且 Surge 支持的节点
+      parts.push(...usable.map((n) => quoteName(n.name)), ...memberNames.filter((m) => !usableNames.has(m)));
+      if (usable.length === 0) parts.push('DIRECT');
+    } else {
+      parts.push(...(memberNames.length ? memberNames : ['DIRECT']));
+    }
+    if (g.type !== 'select') {
+      parts.push(`url=${g.testUrl || 'http://cp.cloudflare.com/generate_204'}`);
+      if (g.interval) parts.push(`interval=${g.interval}`);
+      if (g.tolerance) parts.push(`tolerance=${g.tolerance}`);
+    }
+    lines.push(`${g.name} = ${parts.join(', ')}`);
+  }
+
+  lines.push('', '[Rule]');
+  for (const r of ir.rules) {
+    if (r.type === 'FINAL') {
+      lines.push(['FINAL', quoteName(r.policy), ...r.params].join(','));
+      continue;
+    }
+    const value = r.ruleset ? r.ruleset.surgeUrl : r.value;
+    lines.push([r.type, value, quoteName(r.policy), ...r.params].join(','));
+  }
+
+  for (const section of ['Host', 'URL Rewrite', 'Header Rewrite', 'MITM', 'Script']) {
+    if (ir.sections[section]) {
+      lines.push('', `[${section}]`, ir.sections[section]);
+    }
+  }
+
+  return { content: lines.join('\n') + '\n', excluded };
+}
--- a/server/src/services/ir.ts
+++ b/server/src/services/ir.ts
@@ -0,0 +1,131 @@
+import { asc, eq } from 'drizzle-orm';
+import { db } from '../db/index.js';
+import { groupMembers, nodes, policyGroups, rules, rulesets, settings } from '../db/schema.js';
+import type { NodeDto } from '@proxy-station/shared';
+import { rowToDto } from '../routes/nodes.js';
+
+export interface GroupIR {
+  name: string;
+  type: 'select' | 'url-test' | 'fallback';
+  testUrl: string | null;
+  interval: number | null;
+  tolerance: number | null;
+  filterRegex: string | null;
+  includeAllNodes: boolean;
+  /** 有序成员：节点名 / 组名 / DIRECT 等内置策略 */
+  members: { kind: 'node' | 'group' | 'builtin'; name: string }[];
+}
+
+export interface RuleIR {
+  type: string;
+  value: string | null;
+  policy: string;
+  params: string[];
+  ruleset: {
+    id: string;
+    name: string;
+    surgeUrl: string;
+    clashUrl: string | null;
+    clashBehavior: string;
+    clashFormat: string;
+    needsConvert: boolean;
+  } | null;
+}
+
+export interface ProfileIR {
+  nodes: NodeDto[]; // 仅启用节点，按 sortOrder
+  groups: GroupIR[];
+  rules: RuleIR[]; // 仅启用规则，按 seq
+  sections: Record<string, string>; // Surge 原文段落（General/Host/…）
+}
+
+export function getSetting(key: string): string {
+  const row = db.select().from(settings).where(eq(settings.key, key)).get();
+  return row?.value ?? '';
+}
+
+export function setSetting(key: string, value: string) {
+  db.insert(settings)
+    .values({ key, value })
+    .onConflictDoUpdate({ target: settings.key, set: { value } })
+    .run();
+}
+
+/**
+ * @param opts.nodeIds 订阅分配的节点范围；为空或未提供时下发全部启用节点
+ */
+export function buildProfileIR(opts: { nodeIds?: string[] } = {}): ProfileIR {
+  const allowed = opts.nodeIds && opts.nodeIds.length > 0 ? new Set(opts.nodeIds) : null;
+  const nodeRows = db
+    .select()
+    .from(nodes)
+    .where(eq(nodes.enabled, true))
+    .orderBy(asc(nodes.sortOrder), asc(nodes.name))
+    .all()
+    .map(rowToDto)
+    .filter((n) => !allowed || allowed.has(n.id));
+  const nodeById = new Map(nodeRows.map((n) => [n.id, n]));
+
+  const memberRows = db.select().from(groupMembers).orderBy(asc(groupMembers.sortOrder)).all();
+  const allGroupRows = db.select().from(policyGroups).orderBy(asc(policyGroups.sortOrder)).all();
+  // 停用的组从输出中剔除；引用它的成员与规则一并跳过，保证产物有效
+  const groupRows = allGroupRows.filter((g) => g.enabled);
+  const liveNames = new Set(groupRows.map((g) => g.name));
+  const BUILTIN_POLICIES = new Set(['DIRECT', 'REJECT', 'REJECT-DROP', 'REJECT-NO-DROP', 'REJECT-TINYGIF']);
+  /** 组已被删除或停用时，引用它的成员/规则应当跳过 */
+  const isDeadRef = (name: string) => !liveNames.has(name) && !BUILTIN_POLICIES.has(name);
+  const groups: GroupIR[] = groupRows.map((g) => ({
+    name: g.name,
+    type: g.type,
+    testUrl: g.testUrl,
+    interval: g.interval,
+    tolerance: g.tolerance,
+    filterRegex: g.filterRegex,
+    includeAllNodes: g.includeAllNodes,
+    members: memberRows
+      .filter((m) => m.groupId === g.id)
+      .flatMap((m): GroupIR['members'] => {
+        if (m.memberKind === 'node') {
+          const node = m.nodeId ? nodeById.get(m.nodeId) : undefined;
+          return node ? [{ kind: 'node', name: node.name }] : []; // 被禁用/删除的节点成员跳过
+        }
+        if (!m.refName) return [];
+        if (m.memberKind === 'group' && isDeadRef(m.refName)) return [];
+        return [{ kind: m.memberKind, name: m.refName }];
+      }),
+  }));
+
+  const setRows = new Map(db.select().from(rulesets).all().map((r) => [r.id, r]));
+  const ruleRows = db
+    .select()
+    .from(rules)
+    .where(eq(rules.enabled, true))
+    .orderBy(asc(rules.seq))
+    .all()
+    .filter((r) => r.type === 'FINAL' || !isDeadRef(r.policy))
+    // FINAL 必须保留：其策略组被停用或删除时兜底 DIRECT
+    .map((r) => (r.type === 'FINAL' && isDeadRef(r.policy) ? { ...r, policy: 'DIRECT' } : r));
+  const ruleIRs: RuleIR[] = ruleRows.map((r) => {
+    const rs = r.value ? setRows.get(r.value) : undefined;
+    return {
+      type: r.type,
+      value: r.value,
+      policy: r.policy,
+      params: JSON.parse(r.params),
+      ruleset: rs ?? null,
+    };
+  });
+
+  const sections: Record<string, string> = {};
+  for (const key of ['General', 'Host', 'URL Rewrite', 'Header Rewrite', 'MITM', 'Script']) {
+    const v = getSetting(`surge:${key}`);
+    if (v) sections[key] = v;
+  }
+
+  return {
+    nodes: nodeRows,
+    groups,
+    rules: ruleIRs,
+    sections,
+  };
+}
--- a/server/src/services/rulesets/convert.test.ts
+++ b/server/src/services/rulesets/convert.test.ts
@@ -0,0 +1,29 @@
+import { describe, expect, it } from 'vitest';
+import YAML from 'yaml';
+import { convertSurgeList } from './convert.js';
+
+describe('convertSurgeList', () => {
+  it('classical：保留支持类型与 no-resolve，丢弃 USER-AGENT', () => {
+    const input = [
+      '# 注释',
+      'DOMAIN,example.com',
+      'DOMAIN-SUFFIX,example.org',
+      'IP-CIDR,10.0.0.0/8,no-resolve',
+      'USER-AGENT,Foo*',
+      'URL-REGEX,^http://bad',
+    ].join('\n');
+    const result = convertSurgeList(input, 'classical');
+    expect(YAML.parse(result.yaml).payload).toEqual([
+      'DOMAIN,example.com',
+      'DOMAIN-SUFFIX,example.org',
+      'IP-CIDR,10.0.0.0/8,no-resolve',
+    ]);
+    expect(result.dropped).toHaveLength(2);
+    expect(result.total).toBe(5);
+  });
+
+  it('domain（domainset）：前导点转 +.', () => {
+    const result = convertSurgeList('example.com\n.cdn.example.com', 'domain');
+    expect(YAML.parse(result.yaml).payload).toEqual(['example.com', '+.cdn.example.com']);
+  });
+});
--- a/server/src/services/rulesets/convert.ts
+++ b/server/src/services/rulesets/convert.ts
@@ -0,0 +1,65 @@
+import YAML from 'yaml';
+
+/** mihomo classical provider 支持的规则类型 */
+const CLASSICAL_TYPES = new Set([
+  'DOMAIN',
+  'DOMAIN-SUFFIX',
+  'DOMAIN-KEYWORD',
+  'DOMAIN-REGEX',
+  'IP-CIDR',
+  'IP-CIDR6',
+  'IP-ASN',
+  'GEOIP',
+  'PROCESS-NAME',
+  'PROCESS-PATH',
+  'DST-PORT',
+  'SRC-PORT',
+]);
+
+export interface ConvertResult {
+  yaml: string;
+  total: number;
+  converted: number;
+  dropped: string[]; // 被丢弃的行（Clash 不支持的类型）
+}
+
+/**
+ * Surge .list/.conf 规则集 → Clash rule-provider yaml。
+ * behavior=domain 时按 domainset 处理（每行一个域名，.former 前缀转 +.）。
+ */
+export function convertSurgeList(content: string, behavior: 'classical' | 'domain' | 'ipcidr'): ConvertResult {
+  const lines = content
+    .split(/\r?\n/)
+    .map((l) => l.trim())
+    .filter((l) => l && !l.startsWith('#') && !l.startsWith('//') && !l.startsWith(';'));
+
+  const payload: string[] = [];
+  const dropped: string[] = [];
+
+  for (const line of lines) {
+    if (behavior === 'domain') {
+      // Surge domainset：`example.com` 或 `.example.com`（含子域）→ Clash `example.com` / `+.example.com`
+      payload.push(line.startsWith('.') ? `+${line}` : line);
+      continue;
+    }
+    if (behavior === 'ipcidr') {
+      payload.push(line);
+      continue;
+    }
+    const parts = line.split(',').map((p) => p.trim());
+    const type = parts[0];
+    if (!CLASSICAL_TYPES.has(type)) {
+      dropped.push(line);
+      continue;
+    }
+    const params = parts.slice(2).filter((p) => p === 'no-resolve');
+    payload.push([type, parts[1], ...params].join(','));
+  }
+
+  return {
+    yaml: YAML.stringify({ payload }, { lineWidth: 0 }),
+    total: lines.length,
+    converted: payload.length,
+    dropped,
+  };
+}
--- a/server/src/services/rulesets/fetch.ts
+++ b/server/src/services/rulesets/fetch.ts
@@ -0,0 +1,48 @@
+import { eq } from 'drizzle-orm';
+import { Agent, fetch as undiciFetch } from 'undici';
+import { db } from '../../db/index.js';
+import { rulesetCache } from '../../db/schema.js';
+
+const CACHE_TTL_MS = 24 * 60 * 60 * 1000;
+
+// 规则集拉取一律直连（显式 Agent，隔离环境注入的 HTTPS_PROXY）
+function dispatcher() {
+  return new Agent();
+}
+
+export interface FetchResult {
+  content: string;
+  fetchedAt: number;
+  stale: boolean; // 拉取失败时回落陈旧缓存
+}
+
+export async function fetchRulesetContent(url: string, opts: { refresh?: boolean } = {}): Promise<FetchResult> {
+  const cached = db.select().from(rulesetCache).where(eq(rulesetCache.url, url)).get();
+  const fresh = cached && Date.now() - cached.fetchedAt < CACHE_TTL_MS;
+  if (cached && fresh && !opts.refresh) {
+    return { content: cached.content, fetchedAt: cached.fetchedAt, stale: false };
+  }
+
+  try {
+    const headers: Record<string, string> = { 'user-agent': 'proxy-station/0.1' };
+    if (cached?.etag) headers['if-none-match'] = cached.etag;
+    const res = await undiciFetch(url, { dispatcher: dispatcher(), headers });
+    if (res.status === 304 && cached) {
+      const fetchedAt = Date.now();
+      db.update(rulesetCache).set({ fetchedAt }).where(eq(rulesetCache.url, url)).run();
+      return { content: cached.content, fetchedAt, stale: false };
+    }
+    if (res.status !== 200) throw new Error(`HTTP ${res.status}`);
+    const content = await res.text();
+    const etag = res.headers.get('etag');
+    const fetchedAt = Date.now();
+    db.insert(rulesetCache)
+      .values({ url, content, etag, fetchedAt })
+      .onConflictDoUpdate({ target: rulesetCache.url, set: { content, etag, fetchedAt } })
+      .run();
+    return { content, fetchedAt, stale: false };
+  } catch (e) {
+    if (cached) return { content: cached.content, fetchedAt: cached.fetchedAt, stale: true };
+    throw e;
+  }
+}
--- a/server/src/services/rulesets/mapping.ts
+++ b/server/src/services/rulesets/mapping.ts
@@ -0,0 +1,53 @@
+/**
+ * Surge 规则集 URL → Clash 等价 URL 的静态映射。
+ * 映射不到的返回 needsConvert=true，走自托管兜底转换端点。
+ */
+
+export interface RulesetMapping {
+  clashUrl: string | null;
+  clashBehavior: 'classical' | 'domain' | 'ipcidr';
+  clashFormat: 'yaml' | 'text';
+  needsConvert: boolean;
+}
+
+export function mapRulesetUrl(surgeUrl: string, ruleType: 'RULE-SET' | 'DOMAIN-SET'): RulesetMapping {
+  // skk.moe：List/{non_ip|ip|domainset}/{name}.conf → Clash/{同路径}/{name}.txt
+  const skk = surgeUrl.match(/^https:\/\/ruleset\.skk\.moe\/List\/(non_ip|ip|domainset)\/([\w-]+)\.conf$/);
+  if (skk) {
+    const [, dir, name] = skk;
+    return {
+      clashUrl: `https://ruleset.skk.moe/Clash/${dir}/${name}.txt`,
+      clashBehavior: dir === 'domainset' ? 'domain' : 'classical',
+      clashFormat: 'text',
+      needsConvert: false,
+    };
+  }
+
+  // blackmatrix7：rule/Surge/{Name}/{Name}.list → rule/Clash/{Name}/{Name}.yaml
+  const bm7 = surgeUrl.match(
+    /^https:\/\/raw\.githubusercontent\.com\/blackmatrix7\/ios_rule_script\/master\/rule\/Surge\/([\w-]+)\/([\w-]+)\.list$/
+  );
+  if (bm7) {
+    const [, dir, name] = bm7;
+    return {
+      clashUrl: `https://raw.githubusercontent.com/blackmatrix7/ios_rule_script/master/rule/Clash/${dir}/${name}.yaml`,
+      clashBehavior: 'classical',
+      clashFormat: 'yaml',
+      needsConvert: false,
+    };
+  }
+
+  // 其余来源（zxfccmm4/Profiles、Semporia/TikTok-Unlock 等）：走兜底转换
+  return {
+    clashUrl: null,
+    clashBehavior: ruleType === 'DOMAIN-SET' ? 'domain' : 'classical',
+    clashFormat: 'yaml',
+    needsConvert: true,
+  };
+}
+
+/** 从 URL 提取展示名：最后一段文件名去扩展名 */
+export function rulesetNameFromUrl(url: string): string {
+  const last = url.split('/').pop() || url;
+  return last.replace(/\.(list|conf|txt|yaml)$/, '');
+}
--- a/server/src/services/sharelink/hysteria2.ts
+++ b/server/src/services/sharelink/hysteria2.ts
@@ -0,0 +1,44 @@
+import { inferTags, readInsecure } from './util.js';
+import type { ParsedShareLink } from './types.js';
+
+// hysteria2://auth@host:port?sni=s&insecure=1&obfs=salamander&obfs-password=x#name
+// hy2:// 是等价别名
+export function parseHysteria2(uri: string): ParsedShareLink {
+  const url = new URL(uri);
+  const server = url.hostname;
+  const port = parseInt(url.port || '443', 10);
+  const user = decodeURIComponent(url.username);
+  const pass = decodeURIComponent(url.password);
+  const auth = pass ? `${user}:${pass}` : user;
+  if (!server || !auth) throw new Error('hysteria2 链接缺少 host/auth');
+  const name = decodeURIComponent(url.hash.slice(1)) || 'Hysteria2';
+  const params = url.searchParams;
+  const obfs = params.get('obfs');
+
+  return {
+    name,
+    protocol: 'hysteria2',
+    server,
+    port,
+    network: 'tcp',
+    tls: true,
+    sni: params.get('sni') || null,
+    skipCertVerify: readInsecure(params) || !!(params.get('pinSHA256') || params.get('pinsha256')),
+    password: auth,
+    obfsType: obfs === 'salamander' ? 'salamander' : null,
+    obfsPassword: params.get('obfs-password') || params.get('obfs_password') || null,
+    tags: inferTags(name),
+  };
+}
+
+export function encodeHysteria2(n: ParsedShareLink): string {
+  const params = new URLSearchParams();
+  if (n.sni) params.set('sni', n.sni);
+  if (n.skipCertVerify) params.set('insecure', '1');
+  if (n.obfsType === 'salamander' && n.obfsPassword) {
+    params.set('obfs', 'salamander');
+    params.set('obfs-password', n.obfsPassword);
+  }
+  const qs = params.toString();
+  return `hysteria2://${encodeURIComponent(n.password || '')}@${n.server}:${n.port}${qs ? `?${qs}` : ''}#${encodeURIComponent(n.name)}`;
+}
--- a/server/src/services/sharelink/parse.test.ts
+++ b/server/src/services/sharelink/parse.test.ts
@@ -0,0 +1,167 @@
+import { describe, expect, it } from 'vitest';
+import { encodeShareLink, parseShareLink } from './parse.js';
+
+const PLACEHOLDER_UUID = '00000000-1111-2222-3333-444444444444';
+const PLACEHOLDER_PASS = 'placeholder-password';
+
+describe('vmess', () => {
+  const json = {
+    v: '2',
+    ps: 'Edge Node XX-vmess-direct',
+    add: 'cc.xx.example.com',
+    port: '443',
+    id: PLACEHOLDER_UUID,
+    aid: '0',
+    scy: 'auto',
+    net: 'ws',
+    type: 'none',
+    host: 'cc.xx.example.com',
+    path: '/abc123',
+    tls: 'tls',
+    sni: 'cc.xx.example.com',
+    alpn: '',
+  };
+  const uri = 'vmess://' + Buffer.from(JSON.stringify(json)).toString('base64');
+
+  it('解析 edge-nodes 交付格式', () => {
+    const n = parseShareLink(uri);
+    expect(n).toMatchObject({
+      protocol: 'vmess',
+      server: 'cc.xx.example.com',
+      port: 443,
+      network: 'ws',
+      wsPath: '/abc123',
+      wsHost: 'cc.xx.example.com',
+      tls: true,
+      sni: 'cc.xx.example.com',
+      uuid: PLACEHOLDER_UUID,
+      alterId: 0,
+      tags: ['direct'],
+    });
+  });
+
+  it('round-trip 一致', () => {
+    const n = parseShareLink(uri);
+    expect(parseShareLink(encodeShareLink(n))).toEqual(n);
+  });
+});
+
+describe('trojan', () => {
+  const uri = `trojan://${PLACEHOLDER_PASS}@cc.xx.example.com:443?security=tls&type=ws&host=cc.xx.example.com&path=%2F4688c6&sni=cc.xx.example.com#Edge%20Node%20XX-trojan-warp-clean-exit`;
+
+  it('解析 edge-nodes 交付格式', () => {
+    const n = parseShareLink(uri);
+    expect(n).toMatchObject({
+      protocol: 'trojan',
+      server: 'cc.xx.example.com',
+      port: 443,
+      network: 'ws',
+      wsPath: '/4688c6',
+      wsHost: 'cc.xx.example.com',
+      tls: true,
+      password: PLACEHOLDER_PASS,
+      tags: ['warp'],
+    });
+    expect(n.name).toBe('Edge Node XX-trojan-warp-clean-exit');
+  });
+
+  it('round-trip 一致', () => {
+    const n = parseShareLink(uri);
+    expect(parseShareLink(encodeShareLink(n))).toEqual(n);
+  });
+});
+
+describe('shadowsocks', () => {
+  const userinfo = Buffer.from(`chacha20-poly1305:${PLACEHOLDER_PASS}`).toString('base64url');
+  const plugin = encodeURIComponent('v2ray-plugin;tls;mode=websocket;host=cc.xx.example.com;path=/22a3d7');
+  const uri = `ss://${userinfo}@cc.xx.example.com:443?plugin=${plugin}#ss-direct`;
+
+  it('解析 SIP002 + v2ray-plugin（SS over WS+TLS）', () => {
+    const n = parseShareLink(uri);
+    expect(n).toMatchObject({
+      protocol: 'shadowsocks',
+      server: 'cc.xx.example.com',
+      port: 443,
+      network: 'ws',
+      wsPath: '/22a3d7',
+      wsHost: 'cc.xx.example.com',
+      tls: true,
+      method: 'chacha20-poly1305',
+      password: PLACEHOLDER_PASS,
+    });
+  });
+
+  it('round-trip 一致', () => {
+    const n = parseShareLink(uri);
+    expect(parseShareLink(encodeShareLink(n))).toEqual(n);
+  });
+
+  it('解析纯 TCP 的 SIP002', () => {
+    const n = parseShareLink(`ss://${userinfo}@1.2.3.4:8388#plain`);
+    expect(n).toMatchObject({ network: 'tcp', tls: false, server: '1.2.3.4', port: 8388 });
+  });
+
+  it('解析 Xray 风格参数（3x-ui 导出格式）', () => {
+    const uri = `ss://${userinfo}@cc.xx.example.com:443?type=ws&security=tls&path=%2F22a3d7&sni=cc.xx.example.com#ss-warp`;
+    expect(parseShareLink(uri)).toMatchObject({
+      network: 'ws',
+      wsPath: '/22a3d7',
+      wsHost: 'cc.xx.example.com',
+      tls: true,
+      sni: 'cc.xx.example.com',
+      method: 'chacha20-poly1305',
+    });
+  });
+});
+
+describe('hysteria2', () => {
+  const uri = `hysteria2://${PLACEHOLDER_PASS}@hy2.xx.example.com:443?sni=hy2.xx.example.com&obfs=salamander&obfs-password=obfs-placeholder#hy2-direct`;
+
+  it('解析含 salamander obfs 的链接', () => {
+    const n = parseShareLink(uri);
+    expect(n).toMatchObject({
+      protocol: 'hysteria2',
+      server: 'hy2.xx.example.com',
+      port: 443,
+      tls: true,
+      password: PLACEHOLDER_PASS,
+      obfsType: 'salamander',
+      obfsPassword: 'obfs-placeholder',
+    });
+  });
+
+  it('round-trip 一致', () => {
+    const n = parseShareLink(uri);
+    expect(parseShareLink(encodeShareLink(n))).toEqual(n);
+  });
+
+  it('hy2:// 别名可解析', () => {
+    expect(parseShareLink(uri.replace('hysteria2://', 'hy2://')).protocol).toBe('hysteria2');
+  });
+});
+
+describe('节点命名规范', () => {
+  // 与 web/src/utils/nodeName.ts 的 TRAILING_EGRESS 保持一致
+  const strip = (name: string) => name.replace(/[\s·・_-]+(direct|warp|直连)\s*$/iu, '').trim();
+
+  it('界面显示名剥掉末尾出口词', () => {
+    expect(strip('🇺🇸 US LA Trojan Warp')).toBe('🇺🇸 US LA Trojan');
+    expect(strip('🇸🇬 SG VMess Direct')).toBe('🇸🇬 SG VMess');
+    expect(strip('🇸🇬 SG · HY2 · 直连')).toBe('🇸🇬 SG · HY2'); // 兼容旧格式
+    expect(strip('无出口词的节点')).toBe('无出口词的节点');
+  });
+
+  it('新命名仍能被地区组正则命中', () => {
+    const sg = /坡|🇸🇬|新加坡|狮城|SG|Singapore/u;
+    const us = /美|🇺🇸|美国|US|States|American/u;
+    expect(sg.test('🇸🇬 SG VMess Direct')).toBe(true);
+    expect(us.test('🇺🇸 US RN HY2 Warp')).toBe(true);
+    expect(sg.test('🇺🇸 US LA Trojan Warp')).toBe(false);
+  });
+});
+
+describe('批量与异常', () => {
+  it('未知协议抛错', () => {
+    expect(() => parseShareLink('vless://x@y:1')).toThrow();
+  });
+});
--- a/server/src/services/sharelink/parse.ts
+++ b/server/src/services/sharelink/parse.ts
@@ -0,0 +1,44 @@
+import { parseVmess, encodeVmess } from './vmess.js';
+import { parseTrojan, encodeTrojan } from './trojan.js';
+import { parseSs, encodeSs } from './ss.js';
+import { parseHysteria2, encodeHysteria2 } from './hysteria2.js';
+import type { ParsedShareLink } from './types.js';
+
+export type { ParsedShareLink };
+
+export function parseShareLink(uri: string): ParsedShareLink {
+  const s = uri.trim();
+  if (s.startsWith('vmess://')) return parseVmess(s);
+  if (s.startsWith('trojan://')) return parseTrojan(s);
+  if (s.startsWith('ss://')) return parseSs(s);
+  if (s.startsWith('hysteria2://') || s.startsWith('hy2://')) return parseHysteria2(s);
+  throw new Error('不支持的链接协议（支持 vmess:// trojan:// ss:// hysteria2://）');
+}
+
+export function encodeShareLink(n: ParsedShareLink): string {
+  switch (n.protocol) {
+    case 'vmess':
+      return encodeVmess(n);
+    case 'trojan':
+      return encodeTrojan(n);
+    case 'shadowsocks':
+      return encodeSs(n);
+    case 'hysteria2':
+      return encodeHysteria2(n);
+  }
+}
+
+/** 多行文本 → 逐行解析（跳过空行与注释行） */
+export function parseShareLinkBatch(text: string): { uri: string; node?: ParsedShareLink; error?: string }[] {
+  return text
+    .split(/\r?\n/)
+    .map((l) => l.trim())
+    .filter((l) => l && !l.startsWith('#') && !l.startsWith('//'))
+    .map((uri) => {
+      try {
+        return { uri, node: parseShareLink(uri) };
+      } catch (e: any) {
+        return { uri, error: e.message || '解析失败' };
+      }
+    });
+}
--- a/server/src/services/sharelink/ss.ts
+++ b/server/src/services/sharelink/ss.ts
@@ -0,0 +1,102 @@
+import { b64decode, inferTags, normalizeWsPath } from './util.js';
+import type { ParsedShareLink } from './types.js';
+
+// SIP002: ss://base64url(method:password)@host:port?plugin=v2ray-plugin%3Btls%3Bmode%3Dwebsocket%3Bpath%3D%2Fx%3Bhost%3Dh#name
+// 旧格式: ss://base64(method:password@host:port)#name
+export function parseSs(uri: string): ParsedShareLink {
+  const url = new URL(uri);
+  let method: string;
+  let password: string;
+  let server: string;
+  let port: number;
+
+  if (url.username) {
+    const decoded = b64decode(decodeURIComponent(url.username));
+    const idx = decoded.indexOf(':');
+    if (idx === -1) throw new Error('ss userinfo 缺少 method:password');
+    method = decoded.slice(0, idx);
+    password = decoded.slice(idx + 1);
+    server = url.hostname;
+    port = parseInt(url.port, 10);
+  } else {
+    // 整体 base64 的旧格式
+    const decoded = b64decode(uri.slice('ss://'.length).split('#')[0]);
+    const at = decoded.lastIndexOf('@');
+    if (at === -1) throw new Error('无法解析 ss 链接');
+    const [m, ...rest] = decoded.slice(0, at).split(':');
+    method = m;
+    password = rest.join(':');
+    const hostPort = decoded.slice(at + 1);
+    const colon = hostPort.lastIndexOf(':');
+    server = hostPort.slice(0, colon);
+    port = parseInt(hostPort.slice(colon + 1), 10);
+  }
+  if (!server || !port || !method) throw new Error('ss 链接缺少 server/port/method');
+
+  const name = decodeURIComponent(url.hash.slice(1)) || 'Shadowsocks';
+  const node: ParsedShareLink = {
+    name,
+    protocol: 'shadowsocks',
+    server,
+    port,
+    network: 'tcp',
+    tls: false,
+    method,
+    password,
+    tags: inferTags(name),
+  };
+
+  // Xray 风格参数（3x-ui 导出即此形式）：type=ws&security=tls&path=&host=&sni=
+  const params = url.searchParams;
+  if (params.get('type') === 'ws') {
+    node.network = 'ws';
+    node.wsPath = normalizeWsPath(params.get('path'));
+    node.wsHost = params.get('host') || params.get('sni') || null;
+  }
+  if (params.get('security') === 'tls') {
+    node.tls = true;
+    node.sni = params.get('sni') || node.wsHost || null;
+  }
+
+  // v2ray-plugin 的 websocket/tls 参数（ShadowRocket、ClashMeta 通用写法）
+  const plugin = params.get('plugin');
+  if (plugin && plugin.includes('v2ray-plugin')) {
+    const opts = new Map(
+      plugin
+        .split(';')
+        .slice(1)
+        .map((kv) => {
+          const eq = kv.indexOf('=');
+          return eq === -1 ? [kv, 'true'] : [kv.slice(0, eq), kv.slice(eq + 1)];
+        }) as [string, string][]
+    );
+    if (opts.get('mode') === 'websocket') {
+      node.network = 'ws';
+      node.wsPath = normalizeWsPath(opts.get('path'));
+      node.wsHost = opts.get('host') || null;
+    }
+    if (opts.has('tls')) {
+      node.tls = true;
+      node.sni = opts.get('host') || null;
+    }
+  }
+  return node;
+}
+
+export function encodeSs(n: ParsedShareLink): string {
+  const userinfo = Buffer.from(`${n.method}:${n.password}`, 'utf8')
+    .toString('base64')
+    .replace(/\+/g, '-')
+    .replace(/\//g, '_')
+    .replace(/=+$/, '');
+  let uri = `ss://${userinfo}@${n.server}:${n.port}`;
+  if (n.network === 'ws') {
+    const parts = ['v2ray-plugin'];
+    if (n.tls) parts.push('tls');
+    parts.push('mode=websocket');
+    if (n.wsHost) parts.push(`host=${n.wsHost}`);
+    if (n.wsPath) parts.push(`path=${n.wsPath}`);
+    uri += `?plugin=${encodeURIComponent(parts.join(';'))}`;
+  }
+  return `${uri}#${encodeURIComponent(n.name)}`;
+}
--- a/server/src/services/sharelink/trojan.ts
+++ b/server/src/services/sharelink/trojan.ts
@@ -0,0 +1,41 @@
+import { inferTags, normalizeWsPath, readInsecure } from './util.js';
+import type { ParsedShareLink } from './types.js';
+
+// trojan://password@host:port?security=tls&type=ws&host=h&path=%2Fx&sni=s#name
+export function parseTrojan(uri: string): ParsedShareLink {
+  const url = new URL(uri);
+  const server = url.hostname;
+  const port = parseInt(url.port || '443', 10);
+  const password = decodeURIComponent(url.username);
+  if (!server || !password) throw new Error('trojan 链接缺少 host/password');
+  const name = decodeURIComponent(url.hash.slice(1)) || 'Trojan';
+  const params = url.searchParams;
+  const network = params.get('type') === 'ws' ? 'ws' : 'tcp';
+
+  return {
+    name,
+    protocol: 'trojan',
+    server,
+    port,
+    network,
+    wsPath: network === 'ws' ? normalizeWsPath(params.get('path')) : null,
+    wsHost: network === 'ws' ? params.get('host') : null,
+    tls: true,
+    sni: params.get('sni') || server,
+    skipCertVerify: readInsecure(params),
+    password,
+    tags: inferTags(name),
+  };
+}
+
+export function encodeTrojan(n: ParsedShareLink): string {
+  const params = new URLSearchParams();
+  params.set('security', 'tls');
+  if (n.network === 'ws') {
+    params.set('type', 'ws');
+    if (n.wsHost) params.set('host', n.wsHost);
+    if (n.wsPath) params.set('path', n.wsPath);
+  }
+  if (n.sni) params.set('sni', n.sni);
+  return `trojan://${encodeURIComponent(n.password || '')}@${n.server}:${n.port}?${params.toString()}#${encodeURIComponent(n.name)}`;
+}
--- a/server/src/services/sharelink/types.ts
+++ b/server/src/services/sharelink/types.ts
@@ -0,0 +1,23 @@
+import type { Protocol } from '@proxy-station/shared';
+
+/** 分享链接解析出的节点字段（与 nodeInputSchema 对齐，未落库） */
+export interface ParsedShareLink {
+  name: string;
+  protocol: Protocol;
+  server: string;
+  port: number;
+  network: 'tcp' | 'ws';
+  wsPath?: string | null;
+  wsHost?: string | null;
+  tls: boolean;
+  sni?: string | null;
+  skipCertVerify?: boolean;
+  uuid?: string | null;
+  alterId?: number;
+  security?: string;
+  password?: string | null;
+  method?: string | null;
+  obfsType?: 'salamander' | null;
+  obfsPassword?: string | null;
+  tags?: string[];
+}
--- a/server/src/services/sharelink/util.ts
+++ b/server/src/services/sharelink/util.ts
@@ -0,0 +1,27 @@
+export function b64decode(s: string): string {
+  return Buffer.from(s.replace(/-/g, '+').replace(/_/g, '/'), 'base64').toString('utf8');
+}
+
+export function b64encode(s: string): string {
+  return Buffer.from(s, 'utf8').toString('base64');
+}
+
+/** WS path 统一保证以 / 开头 */
+export function normalizeWsPath(p: string | null | undefined): string | null {
+  if (!p) return null;
+  return p.startsWith('/') ? p : `/${p}`;
+}
+
+export function readInsecure(params: URLSearchParams): boolean {
+  const v = params.get('insecure') || params.get('allowInsecure') || params.get('skip-cert-verify');
+  return v === '1' || v === 'true';
+}
+
+/** 从节点名推断出口 tag（warp/direct），供前端线路矩阵归位 */
+export function inferTags(name: string): string[] {
+  const lower = name.toLowerCase();
+  const tags: string[] = [];
+  if (lower.includes('warp')) tags.push('warp');
+  else if (lower.includes('direct')) tags.push('direct');
+  return tags;
+}
--- a/server/src/services/sharelink/vmess.ts
+++ b/server/src/services/sharelink/vmess.ts
@@ -0,0 +1,50 @@
+import { b64decode, inferTags, normalizeWsPath } from './util.js';
+import type { ParsedShareLink } from './types.js';
+
+// vmess://base64({"v":"2","ps":name,"add":host,"port":"443","id":uuid,"aid":"0",
+//   "scy":"auto","net":"ws","type":"none","host":wsHost,"path":"/x","tls":"tls","sni":sni})
+export function parseVmess(uri: string): ParsedShareLink {
+  const json = JSON.parse(b64decode(uri.slice('vmess://'.length)));
+  const name = json.ps || 'VMess';
+  const server = String(json.add || '');
+  const port = parseInt(String(json.port || '0'), 10);
+  const uuid = String(json.id || '');
+  if (!server || !port || !uuid) throw new Error('vmess 链接缺少 add/port/id');
+
+  const network = json.net === 'ws' ? 'ws' : 'tcp';
+  return {
+    name,
+    protocol: 'vmess',
+    server,
+    port,
+    network,
+    wsPath: network === 'ws' ? normalizeWsPath(json.path) : null,
+    wsHost: network === 'ws' ? json.host || null : null,
+    tls: json.tls === 'tls',
+    sni: json.sni || null,
+    uuid,
+    alterId: parseInt(String(json.aid ?? '0'), 10) || 0,
+    security: json.scy || 'auto',
+    tags: inferTags(name),
+  };
+}
+
+export function encodeVmess(n: ParsedShareLink): string {
+  const json: Record<string, string> = {
+    v: '2',
+    ps: n.name,
+    add: n.server,
+    port: String(n.port),
+    id: n.uuid || '',
+    aid: String(n.alterId ?? 0),
+    scy: n.security || 'auto',
+    net: n.network === 'ws' ? 'ws' : 'tcp',
+    type: 'none',
+    host: n.wsHost || '',
+    path: n.wsPath || '',
+    tls: n.tls ? 'tls' : '',
+    sni: n.sni || '',
+    alpn: '',
+  };
+  return 'vmess://' + Buffer.from(JSON.stringify(json)).toString('base64');
+}
--- a/server/src/services/template/surge-parser.test.ts
+++ b/server/src/services/template/surge-parser.test.ts
@@ -0,0 +1,55 @@
+import { describe, expect, it } from 'vitest';
+import { parseSurgeConf, splitTopLevel } from './surge-parser.js';
+
+describe('splitTopLevel', () => {
+  it('引号内逗号不切分', () => {
+    expect(splitTopLevel('select, "Hong Kong", Taiwan')).toEqual(['select', '"Hong Kong"', 'Taiwan']);
+  });
+  it('括号内逗号不切分（AND 复合规则）', () => {
+    expect(splitTopLevel('AND,((PROTOCOL,UDP), (DOMAIN-SUFFIX,googlevideo.com)),REJECT-NO-DROP')).toEqual([
+      'AND',
+      '((PROTOCOL,UDP), (DOMAIN-SUFFIX,googlevideo.com))',
+      'REJECT-NO-DROP',
+    ]);
+  });
+});
+
+describe('parseSurgeConf', () => {
+  const conf = `
+[General]
+ipv6 = false
+
+[Proxy Group]
+Auto = url-test, include-other-group=All, policy-regex-filter=SG|Singapore, url=http://x/gen, interval=300, tolerance=50, icon-url=http://icon
+Pick = select, Auto, "Hong Kong", DIRECT
+All = select, policy-path="placeholder", hidden=0
+
+[Rule]
+RULE-SET,https://example.com/a.list,Pick
+DOMAIN-SUFFIX,example.com,"Hong Kong",no-resolve
+FINAL,Pick,dns-failed
+
+[MITM]
+hostname = *.example.com
+`;
+  const parsed = parseSurgeConf(conf);
+
+  it('组解析：类型、成员、regex、include-other-group', () => {
+    const auto = parsed.groups.find((g) => g.name === 'Auto')!;
+    expect(auto).toMatchObject({ type: 'url-test', filterRegex: 'SG|Singapore', includeOtherGroup: 'All', interval: 300, tolerance: 50 });
+    const pick = parsed.groups.find((g) => g.name === 'Pick')!;
+    expect(pick.members).toEqual(['Auto', 'Hong Kong', 'DIRECT']);
+    expect(parsed.groups.find((g) => g.name === 'All')!.hasPolicyPath).toBe(true);
+  });
+
+  it('规则解析：RULE-SET、带引号策略、FINAL 参数', () => {
+    expect(parsed.rules[0]).toMatchObject({ type: 'RULE-SET', value: 'https://example.com/a.list', policy: 'Pick' });
+    expect(parsed.rules[1]).toMatchObject({ type: 'DOMAIN-SUFFIX', policy: 'Hong Kong', params: ['no-resolve'] });
+    expect(parsed.rules[2]).toMatchObject({ type: 'FINAL', policy: 'Pick', params: ['dns-failed'] });
+  });
+
+  it('其他段落原文保留', () => {
+    expect(parsed.sections['MITM']).toBe('hostname = *.example.com');
+    expect(parsed.sections['General']).toBe('ipv6 = false');
+  });
+});
--- a/server/src/services/template/surge-parser.ts
+++ b/server/src/services/template/surge-parser.ts
@@ -0,0 +1,159 @@
+/**
+ * 解析 Surge .conf 模板：分段原文 + [Proxy Group] / [Rule] 的结构化结果。
+ * 只解析本项目建模所需的字段，未识别的组参数原样忽略。
+ */
+
+export interface ParsedGroup {
+  name: string;
+  type: 'select' | 'url-test' | 'fallback';
+  members: string[]; // 组名或 DIRECT/REJECT，顺序保留
+  testUrl?: string;
+  interval?: number;
+  tolerance?: number;
+  filterRegex?: string;
+  includeOtherGroup?: string;
+  includeAllProxies?: boolean;
+  hasPolicyPath?: boolean; // 上游订阅占位（AllServer）→ 我们的「全部节点」组
+}
+
+export interface ParsedRule {
+  type: string;
+  value: string | null;
+  policy: string;
+  params: string[]; // 如 no-resolve / dns-failed / extended-matching
+}
+
+export interface ParsedSurgeConf {
+  sections: Record<string, string>; // 段名（不含中括号）→ 原文
+  groups: ParsedGroup[];
+  rules: ParsedRule[];
+}
+
+/** 按逗号切分，但忽略引号与括号内部的逗号 */
+export function splitTopLevel(line: string): string[] {
+  const out: string[] = [];
+  let cur = '';
+  let depth = 0;
+  let quote: string | null = null;
+  for (const ch of line) {
+    if (quote) {
+      cur += ch;
+      if (ch === quote) quote = null;
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      quote = ch;
+      cur += ch;
+      continue;
+    }
+    if (ch === '(') depth++;
+    if (ch === ')') depth--;
+    if (ch === ',' && depth === 0) {
+      out.push(cur.trim());
+      cur = '';
+      continue;
+    }
+    cur += ch;
+  }
+  if (cur.trim()) out.push(cur.trim());
+  return out;
+}
+
+function unquote(s: string): string {
+  if ((s.startsWith('"') && s.endsWith('"')) || (s.startsWith("'") && s.endsWith("'"))) {
+    return s.slice(1, -1);
+  }
+  return s;
+}
+
+const KNOWN_GROUP_TYPES = new Set(['select', 'url-test', 'fallback']);
+/** 这些参数不建模，序列化 Surge 时也不透传（icon 等纯装饰） */
+const RULE_PARAM_WHITELIST = new Set(['no-resolve', 'dns-failed', 'extended-matching', 'force-remote-dns']);
+
+export function parseSurgeConf(text: string): ParsedSurgeConf {
+  const sections: Record<string, string[]> = {};
+  let current = '';
+  for (const raw of text.split(/\r?\n/)) {
+    const trimmed = raw.trim();
+    const m = trimmed.match(/^\[(.+)\]$/);
+    if (m) {
+      current = m[1];
+      sections[current] = [];
+      continue;
+    }
+    if (current) sections[current].push(raw);
+  }
+
+  const groups: ParsedGroup[] = [];
+  for (const raw of sections['Proxy Group'] ?? []) {
+    const line = raw.trim();
+    if (!line || line.startsWith('#') || line.startsWith('//')) continue;
+    const eq = line.indexOf('=');
+    if (eq === -1) continue;
+    const name = line.slice(0, eq).trim();
+    const parts = splitTopLevel(line.slice(eq + 1));
+    const type = parts[0];
+    if (!KNOWN_GROUP_TYPES.has(type)) continue;
+
+    const group: ParsedGroup = { name, type: type as ParsedGroup['type'], members: [] };
+    for (const part of parts.slice(1)) {
+      const kvEq = part.indexOf('=');
+      // 无 = 的项是成员（可能带引号）
+      if (kvEq === -1 || part.startsWith('"') || part.startsWith("'")) {
+        group.members.push(unquote(part));
+        continue;
+      }
+      const key = part.slice(0, kvEq).trim();
+      const value = unquote(part.slice(kvEq + 1).trim());
+      switch (key) {
+        case 'url':
+          group.testUrl = value;
+          break;
+        case 'interval':
+          group.interval = parseInt(value, 10) || undefined;
+          break;
+        case 'tolerance':
+          group.tolerance = parseInt(value, 10) || undefined;
+          break;
+        case 'policy-regex-filter':
+          group.filterRegex = value;
+          break;
+        case 'include-other-group':
+          group.includeOtherGroup = value;
+          break;
+        case 'include-all-proxies':
+          group.includeAllProxies = value === '1' || value === 'true';
+          break;
+        case 'policy-path':
+          group.hasPolicyPath = true;
+          break;
+        // no-alert / hidden / icon-url / update-interval / timeout 等不建模
+      }
+    }
+    groups.push(group);
+  }
+
+  const rules: ParsedRule[] = [];
+  for (const raw of sections['Rule'] ?? []) {
+    const line = raw.trim();
+    if (!line || line.startsWith('#') || line.startsWith('//')) continue;
+    const parts = splitTopLevel(line);
+    const type = parts[0];
+    if (!type) continue;
+    if (type === 'FINAL') {
+      rules.push({ type, value: null, policy: unquote(parts[1] ?? 'DIRECT'), params: parts.slice(2) });
+      continue;
+    }
+    if (parts.length < 3) continue;
+    const params = parts.slice(3).filter((p) => RULE_PARAM_WHITELIST.has(p));
+    rules.push({ type, value: parts[1], policy: unquote(parts[2]), params });
+  }
+
+  const rawSections: Record<string, string> = {};
+  for (const [name, lines] of Object.entries(sections)) {
+    if (name === 'Proxy' || name === 'Proxy Group' || name === 'Rule') continue;
+    rawSections[name] = lines.join('\n').trim();
+  }
+
+  return { sections: rawSections, groups, rules };
+}