1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
# Panel Code Roadmap — Where to Look
## Request Flow
```
Incoming Request
│
▼
┌─────────────────────────┐
│ Main fetch handler │ (export default { fetch })
│ - Decoy 404 for / │
│ - PANEL_KEY check │
│ - Security headers │ ← gi (withSecurityHeaders)
│ - CSRF via Sec-Fetch │
└────────┬────────────────┘
│
▼
┌─────────────────────────┐
│ Route dispatcher │
│ /panel/* → Di │ ← Di (handlePanel)
│ /api/health → $o │ ← $o (handleHealth)
│ /panel/setup → Et/xi │ ← Et, xi (handleSetup)
│ /panel/login → Ai │ ← Ai (renderLoginPage)
└────────┬────────────────┘
│
▼
┌─────────────────────────┐
│ Di (handlePanel) │
│ 1. Check password set │ ← Bt (hasConfiguredPassword)
│ 2. Verify session │ ← qr (verifyPassword)
│ 3. Load settings (KV) │ ← X (getOrInitSettings)
│ 4. Route to tab │ TAB_ROUTES
│ 5. Render page │ ← ki (renderDashboardPage)
└─────────────────────────┘
```
## Where to Look for Common Tasks
### Adding a new panel tab
1. `Di` (handlePanel) — Add route to TAB_ROUTES
2. `ki` (renderDashboardPage) — Add sidebar button + tab pane HTML
3. Client JS `switchTab()` — Already handles generic tabs
### Changing authentication
- `qr` (verifyPassword) — Password verification logic
- `Bt` (hasConfiguredPassword) — Check if password is set
- Session: `getSessionCookie` / `createSessionCookie` (in v13, map in v15)
- Login page: `Ai` (renderLoginPage)
### Modifying settings storage
- `X` (getOrInitSettings) — Load settings from KV
- KV binding: `BK_KV` (or `WD_KV` legacy)
### Adding API endpoint
1. Main fetch handler — Add route
2. Create handler function (see `Hi` handleXhttpProxy as template)
3. Add security headers via `gi` (withSecurityHeaders)
### DNS-related changes
- `yo` (dnsQuestion), `wo` (dnsJson), `xo` (queryDnsJson)
- `lt` (parseResolver), `Eo` (dnsControls)
- `Fo` (singboxDns), `Po` (clashDns), `Ro` (applyXrayDns)
### Subscription/config generation
- `Bo` (mergeNativeSubscription) — Merge subscription configs
- `Wo` (serveShadowsocks) — Serve Shadowsocks configs
## Function Categories
### Panel Core (must understand)
| Func | Name | Purpose |
|------|------|---------|
| `ki` | renderDashboardPage | 89KB - entire panel HTML |
| `Di` | handlePanel | Request routing + auth |
| `Ai` | renderLoginPage | Login form |
| `Et`/`xi` | handleSetup | Initial setup |
### Auth & Security
| Func | Name | Purpose |
|------|------|---------|
| `qr` | verifyPassword | Check password |
| `Bt` | hasConfiguredPassword | Is password set? |
| `gi` | withSecurityHeaders | Add security headers |
| `zt` | bkLoginIp | Get login IP |
### Utilities
| Func | Name | Purpose |
|------|------|---------|
| `X` | getOrInitSettings | Load from KV |
| `$o` | handleHealth | Health check endpoint |
## Confidence Notes
- High confidence: Mapped via 2+ shared strings or manual verification
- `ki`/`Di`: Confirmed by content analysis (sidebar, TAB_ROUTES)
- Low confidence mappings: Check v13 source before relying on them
- Unmapped (~85 functions): Mostly crypto, networking, and protocol internals
arblant